PT-2024-25718 · Jenkins · Jenkins Telegram Bot Plugin+1

Surya Dev Singh Rawal · Published 2024-05-02 · Updated 2025-10-10 · CVE-2024-34147

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Telegram Bot Plugin versions 1.4.0 and earlier

Description The issue concerns the storage of the Telegram Bot token in an unencrypted manner within the global configuration file on the Jenkins controller. This file can be accessed by users with permission to the Jenkins controller file system, potentially exposing the token. The configuration file in question is jenkinsci.plugins.telegrambot.TelegramBotGlobalConfiguration.xml. There is no information provided about the estimated number of potentially affected devices or real-world incidents related to this issue.

Recommendations For Jenkins Telegram Bot Plugin versions 1.4.0 and earlier, as a temporary workaround, consider restricting access to the jenkinsci.plugins.telegrambot.TelegramBotGlobalConfiguration.xml file to minimize the risk of token exposure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2024-34147

GHSA-94PR-W968-H923

Affected Products

Jenkins

Jenkins Telegram Bot Plugin

References · 11

• https://osv.dev/vulnerability/CVE-2024-34147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34147 · Security Note
• https://jenkins.io/security/advisory/2024-05-02/#SECURITY-3294 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-94pr-w968-h923 · Vendor Advisory
• https://github.com/jenkinsci/telegram-notifications-plugin · Note
• http://openwall.com/lists/oss-security/2024/05/02/3 · Note
• https://t.me/cvenotify/78900 · Telegram Post
• https://twitter.com/CVEnew/status/1786027487132324075 · Twitter Post
• https://twitter.com/bluepatch0404/status/1790043443894358199 · Twitter Post
• https://t.me/cvenotify/78848 · Telegram Post
• https://t.me/cveNotify/138152 · Telegram Post