Description
Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers to observe and capture it.
Remediation
References
http://www.openwall.com/lists/oss-security/2022/09/21/5
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2243
Related Vulnerabilities
CVE-2020-11987 Vulnerability in maven package org.apache.xmlgraphics:batik-svgbrowser
CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.enigma2
CVE-2023-48967 Vulnerability in maven package org.noear:solon.serialization.fury
CVE-2019-1003083 Vulnerability in maven package org.jenkins-ci.plugins:gearman-plugin
CVE-2019-10381 Vulnerability in maven package org.jenkins-ci.plugins:codefresh