Description
Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/09/25/3
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1575
Related Vulnerabilities
CVE-2016-6809 Vulnerability in maven package org.apache.tika:tika-parsers
CVE-2020-11022 Vulnerability in maven package org.webjars:jquery
CVE-2019-17495 Vulnerability in maven package io.springfox:springfox-swagger-ui
CVE-2022-41965 Vulnerability in maven package org.opencastproject:opencast-engage-paella-player
CVE-2023-40348 Vulnerability in maven package org.jenkins-ci.plugins:gogs-webhook