Description
Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1031
Related Vulnerabilities
CVE-2020-35149 Vulnerability in maven package org.webjars.npm:mquery
CVE-2022-38639 Vulnerability in npm package markdown-nice
CVE-2020-2264 Vulnerability in maven package org.jenkins-ci.plugins:custom-job-icon
CVE-2023-34981 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2023-28754 Vulnerability in maven package org.apache.shardingsphere:shardingsphere