CVE-2023-50773: 
Java vulnerability analysis and mitigation

CVE-2023-50773 affects the Jenkins Dingding JSON Pusher Plugin versions 2.0 and earlier. The vulnerability was discovered by Andrea Chiera of CloudBees, Inc. and was disclosed on December 13, 2023. This security issue is related to the exposure of access tokens in the job configuration form of the plugin (Jenkins Advisory).

The vulnerability is classified with a CVSS v3.1 base score of 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The technical issue stems from the plugin's failure to mask access tokens that are displayed on the job configuration form, which increases the potential for unauthorized observation and capture of these sensitive credentials (NVD).

The vulnerability exposes access tokens to potential compromise, allowing them to be viewed by attackers who can access the job configuration form. This exposure could lead to unauthorized access to the affected Jenkins systems and their associated resources (Jenkins Advisory).

As of the advisory's publication date, there is no fix available for this vulnerability in the Dingding JSON Pusher Plugin. Users should carefully consider the risk of exposed access tokens and implement additional security controls to restrict access to the job configuration interface (Jenkins Advisory).