Description
Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/09/16/3
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-2014
Related Vulnerabilities
CVE-2018-25083 Vulnerability in npm package pullit
CVE-2021-32770 Vulnerability in npm package gatsby-source-wordpress
CVE-2021-23370 Vulnerability in npm package swiper
CVE-2021-23341 Vulnerability in maven package org.webjars:prismjs
CVE-2020-8237 Vulnerability in maven package org.webjars.bower:json-bigint