Description
Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-957
Related Vulnerabilities
CVE-2021-36374 Vulnerability in maven package org.apache.ant:ant
CVE-2022-2421 Vulnerability in npm package socket.io-parser
CVE-2022-44621 Vulnerability in maven package org.apache.kylin:kylin-server-base
CVE-2020-15092 Vulnerability in npm package @knight-lab/timelinejs
CVE-2022-23913 Vulnerability in maven package org.apache.activemq:artemis-core-client