Description
Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-835
Related Vulnerabilities
CVE-2022-46366 Vulnerability in maven package tapestry:tapestry
CVE-2019-19771 Vulnerability in npm package web3-eht
CVE-2021-23926 Vulnerability in maven package org.apache.xmlbeans:xmlbeans
CVE-2017-5617 Vulnerability in maven package com.metsci.ext.com.kitfox.svg:svg-salamander
CVE-2023-3691 Vulnerability in maven package org.webjars.npm:layui