Description
Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/08/07/1
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1430
https://www.zerodayinitiative.com/advisories/ZDI-19-834/
Related Vulnerabilities
CVE-2022-31172 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts-upgradeable
CVE-2022-45935 Vulnerability in maven package org.apache.james:james-server-data-file
CVE-2020-15215 Vulnerability in npm package electron
CVE-2020-36189 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2022-36083 Vulnerability in npm package jose-node-esm-runtime