Description
Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1434
Related Vulnerabilities
CVE-2019-10243 Vulnerability in maven package org.eclipse.kura:org.eclipse.kura.jetty.customizer
CVE-2019-12421 Vulnerability in maven package org.apache.nifi:nifi-administration
CVE-2020-27220 Vulnerability in maven package org.eclipse.hono:hono-adapter-mqtt-vertx-base
CVE-2023-24998 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2018-17244 Vulnerability in maven package org.elasticsearch:elasticsearch