Description
Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1056
Related Vulnerabilities
CVE-2020-1953 Vulnerability in maven package org.apache.commons:commons-configuration2
CVE-2022-25852 Vulnerability in npm package libpq
CVE-2020-7684 Vulnerability in npm package rollup-plugin-serve
CVE-2021-41862 Vulnerability in maven package com.googlecode.aviator:aviator
CVE-2023-29924 Vulnerability in maven package tech.powerjob:powerjob