CVE-2019-10459: Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token

May 24, 2022 (updated August 12, 2025)

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

References

github.com/advisories/GHSA-xcj6-4355-2823
github.com/jenkinsci/mattermost-plugin
github.com/jenkinsci/mattermost-plugin/commit/c6e509307812d93ba295a35dea95016f007de158
jenkins.io/security/advisory/2019-10-23/
nvd.nist.gov/vuln/detail/CVE-2019-10459

Code Behaviors & Features

Detect and mitigate CVE-2019-10459 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →