Description
Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/04/30/5
http://www.securityfocus.com/bid/108159
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1390
Related Vulnerabilities
CVE-2021-42767 Vulnerability in maven package org.neo4j.procedure:apoc
CVE-2022-31142 Vulnerability in npm package @fastify/bearer-auth
CVE-2020-23811 Vulnerability in maven package com.xuxueli:xxl-job
CVE-2022-3952 Vulnerability in maven package com.manydesigns:portofino-microservice-launcher
CVE-2023-43123 Vulnerability in maven package org.apache.storm:storm-client