Description
Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Remediation
References
https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2156
Related Vulnerabilities
CVE-2020-9486 Vulnerability in maven package org.apache.nifi:nifi-security-utils
CVE-2020-15087 Vulnerability in maven package io.prestosql:presto-main
CVE-2023-40185 Vulnerability in npm package shescape
CVE-2023-40336 Vulnerability in maven package org.jenkins-ci.plugins:cloudbees-folder
CVE-2022-38180 Vulnerability in maven package io.ktor:ktor-client-core