Description
Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/09/16/3
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-2014
Related Vulnerabilities
CVE-2022-39353 Vulnerability in npm package xmldom
CVE-2018-14637 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2022-23464 Vulnerability in maven package com.nepxion:discovery-plugin-admin-center
CVE-2019-19771 Vulnerability in npm package bitcroe-lib
CVE-2018-1999033 Vulnerability in maven package org.jenkins-ci.plugins:anchore-container-scanner