Jenkins IFTTT Build Notifier Plugin Unencrypted Key Storage Vulnerability

A vulnerability exists in the IFTTT Build Notifier Plugin for Jenkins, specifically in versions through 1.2. The plugin stores IFTTT Maker Channel Keys unencrypted in job configuration files on the Jenkins controller. This sensitive information can be accessed by users with Item/Extended Read permission or those who have access to the Jenkins controller file system.

Impact

The vulnerability allows for unauthorized access to IFTTT Maker Channel Keys, which could be misused to trigger IFTTT actions on behalf of the user.