Description
Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/07/31/1
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1435
https://www.zerodayinitiative.com/advisories/ZDI-19-835/
Related Vulnerabilities
CVE-2020-2192 Vulnerability in maven package org.jenkins-ci.plugins:swarm-plugin
CVE-2019-17563 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2023-27987 Vulnerability in maven package org.apache.linkis:linkis-dist
CVE-2023-38647 Vulnerability in maven package org.apache.helix:helix-core
CVE-2022-37616 Vulnerability in maven package org.webjars.npm:xmldom__xmldom