Description
Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/12/17/1
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1597
Related Vulnerabilities
CVE-2020-35213 Vulnerability in maven package io.atomix:atomix
CVE-2021-23463 Vulnerability in maven package com.h2database:h2
CVE-2020-11988 Vulnerability in maven package org.apache.xmlgraphics:xmlgraphics-commons
CVE-2019-16569 Vulnerability in maven package org.jenkins-ci.plugins:mantis
CVE-2021-37404 Vulnerability in maven package org.apache.hadoop:hadoop-hdfs-native-client