Description
Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Remediation
References
https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2156
Related Vulnerabilities
CVE-2022-34783 Vulnerability in maven package org.jenkins-ci.plugins:plot
CVE-2023-24998 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2022-45135 Vulnerability in maven package org.apache.cocoon:cocoon-databases-impl
CVE-2021-21162 Vulnerability in maven package org.webjars.npm:electron
CVE-2018-1000182 Vulnerability in maven package org.jenkins-ci.plugins:git