Description
Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Remediation
References
https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2055
Related Vulnerabilities
CVE-2023-4302 Vulnerability in maven package org.jenkins-ci.plugins:fortify
CVE-2015-0201 Vulnerability in maven package org.springframework:spring-websocket
CVE-2017-16061 Vulnerability in npm package tkinter
CVE-2016-8739 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-extension-providers
CVE-2020-16014 Vulnerability in maven package org.webjars.npm:electron