Description
Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Remediation
References
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2243
Related Vulnerabilities
CVE-2023-40338 Vulnerability in maven package org.jenkins-ci.plugins:cloudbees-folder
CVE-2021-4040 Vulnerability in maven package org.apache.activemq:artemis-commons
CVE-2023-46650 Vulnerability in maven package com.coravy.hudson.plugins.github:github
CVE-2018-1000605 Vulnerability in maven package org.jenkins-ci.plugins:collabnet
CVE-2020-25640 Vulnerability in maven package org.jboss.genericjms:generic-jms-ra-jar