Description
Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/08/07/1
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1428
https://www.zerodayinitiative.com/advisories/ZDI-19-839/
Related Vulnerabilities
CVE-2021-21661 Vulnerability in maven package org.jenkins-ci.plugins:kubernetes-cli
CVE-2021-21341 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2022-31198 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts-upgradeable
CVE-2020-28481 Vulnerability in maven package org.webjars.bower:socket.io
CVE-2022-26884 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-server