Description
Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/09/25/3
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1551
Related Vulnerabilities
CVE-2019-20503 Vulnerability in maven package org.webjars.npm:electron
CVE-2019-10344 Vulnerability in maven package io.jenkins:configuration-as-code
CVE-2022-31198 Vulnerability in npm package @openzeppelin/contracts-upgradeable
CVE-2022-28366 Vulnerability in maven package net.sourceforge.nekohtml:nekohtml
CVE-2021-21388 Vulnerability in npm package systeminformation