Description
Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Remediation
References
https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2089
Related Vulnerabilities
CVE-2022-36906 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer
CVE-2023-29513 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates
CVE-2019-1003078 Vulnerability in maven package org.jenkins-ci.plugins:labmanager
CVE-2023-6394 Vulnerability in maven package io.quarkus:quarkus-smallrye-graphql
CVE-2023-26480 Vulnerability in maven package org.xwiki.platform:xwiki-platform-livedata-webjar