Description
Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-957
Related Vulnerabilities
CVE-2023-3691 Vulnerability in maven package org.webjars.bower:layui
CVE-2022-45399 Vulnerability in maven package org.zeroturnaround:cluster-stats
CVE-2019-10349 Vulnerability in maven package org.jenkins-ci.plugins:depgraph-view
CVE-2022-24881 Vulnerability in maven package com.hccake:ballcat-codegen
CVE-2020-9489 Vulnerability in maven package org.apache.tika:tika-parsers