Description
Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1069
Related Vulnerabilities
CVE-2023-27474 Vulnerability in npm package directus
CVE-2020-28448 Vulnerability in npm package multi-ini
CVE-2019-15608 Vulnerability in maven package org.webjars.npm:yarn
CVE-2020-6422 Vulnerability in npm package electron
CVE-2022-43435 Vulnerability in maven package org.jenkins-ci.plugins.plugin:fireline