Description
Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/07/31/1
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1435
https://www.zerodayinitiative.com/advisories/ZDI-19-835/
Related Vulnerabilities
CVE-2020-24855 Vulnerability in npm package @easy-team/easywebpack-cli
CVE-2020-36180 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2019-1010266 Vulnerability in maven package org.fujion.webjars:lodash
CVE-2019-12041 Vulnerability in maven package org.webjars.npm:remarkable
CVE-2018-1000632 Vulnerability in maven package org.dom4j:dom4j