Description
Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/11/21/1
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%281%29
Related Vulnerabilities
CVE-2021-40110 Vulnerability in maven package org.apache.james:james-server
CVE-2023-30529 Vulnerability in maven package org.jenkins-ci.plugins:lucene-search
CVE-2019-1010266 Vulnerability in maven package org.webjars:lodash
CVE-2023-31066 Vulnerability in maven package org.apache.inlong:manager-web
CVE-2022-22968 Vulnerability in maven package org.springframework:spring-context