Description
Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-838
Related Vulnerabilities
CVE-2019-3773 Vulnerability in maven package org.springframework.ws:spring-ws-core
CVE-2019-10385 Vulnerability in maven package org.jenkins-ci.plugins:eggplant-plugin
CVE-2021-21342 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2023-35887 Vulnerability in maven package org.apache.sshd:sshd-common
CVE-2020-7795 Vulnerability in npm package get-npm-package-version