Description
Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/07/31/1
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1435
https://www.zerodayinitiative.com/advisories/ZDI-19-835/
Related Vulnerabilities
CVE-2020-26939 Vulnerability in maven package org.bouncycastle:bcprov-ext-jdk15on
CVE-2022-29244 Vulnerability in maven package org.webjars.npm:npm
CVE-2023-43498 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2019-0187 Vulnerability in maven package org.apache.jmeter:apachejmeter_core
CVE-2021-32854 Vulnerability in maven package org.webjars.npm:textangular