GHSA-2xpq-5952-38w3LowCVSS 3.7

Jenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison

Published
October 25, 2023
Last Modified
November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-46658 →

📋 Description

Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token are equal.

This could potentially allow attackers to use statistical methods to obtain a valid webhook token.

As of publication of this advisory, there is no fix.

🎯 Affected products1

  • maven/io.jenkins.plugins:teams-webhook-trigger:<= 0.1.1

🔗 References (4)