CVE-2024-34147

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: May 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-341486.8Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is CVE-2024-341496.3In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2024-34154.8A vulnerability was found in SourceCodester Human Resource Information System 1.0. It has been classified as problematic. Affected is an unk CVE-2024-341524.3Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the CVE-2024-341537.8Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enabl CVE-2024-341554.3Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.CVE-2024-341567.5Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up t CVE-2024-341587.5Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.CVE-2024-34169.8A vulnerability classified as critical was found in SourceCodester Online Courseware 1.0. This vulnerability affects unknown code of the fil CVE-2024-341615.3When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Uni CVE-2024-341625.3The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authe CVE-2024-341638.2Improper input validation in firmware for some Intel(R) NUC may allow a privileged user to potentially enableescalation of privilege via loc