Description
Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-830
Related Vulnerabilities
CVE-2019-18394 Vulnerability in maven package org.igniterealtime.openfire:xmppserver
CVE-2019-15532 Vulnerability in npm package cyberchef
CVE-2022-24280 Vulnerability in maven package org.apache.pulsar:pulsar-proxy
CVE-2022-43409 Vulnerability in maven package org.jenkins-ci.plugins.workflow:workflow-support
CVE-2022-25872 Vulnerability in npm package fast-string-search