Description
Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-835
Related Vulnerabilities
CVE-2022-45396 Vulnerability in maven package com.thalesgroup.hudson.plugins:sourcemonitor
CVE-2022-33683 Vulnerability in maven package org.apache.pulsar:pulsar-proxy
CVE-2021-21625 Vulnerability in maven package org.jenkins-ci.plugins:aws-credentials
CVE-2023-40349 Vulnerability in maven package org.jenkins-ci.plugins:gogs-webhook