Description
Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-945
Related Vulnerabilities
CVE-2021-42550 Vulnerability in maven package ch.qos.logback:logback-core
CVE-2021-23358 Vulnerability in maven package org.webjars.bowergithub.jashkenas:underscore
CVE-2023-37259 Vulnerability in npm package matrix-react-sdk
CVE-2021-23364 Vulnerability in npm package browserslist
CVE-2018-1000406 Vulnerability in maven package org.jenkins-ci.main:jenkins-core