Description
Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers to observe and capture it.
Remediation
References
http://www.openwall.com/lists/oss-security/2022/09/21/5
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2243
Related Vulnerabilities
CVE-2022-43441 Vulnerability in maven package org.webjars.npm:sqlite3
CVE-2020-2110 Vulnerability in maven package org.jenkins-ci.plugins:script-security
CVE-2022-36916 Vulnerability in maven package org.jenkins-ci.plugins:google-cloud-backup
CVE-2020-26256 Vulnerability in npm package @fast-csv/parse
CVE-2018-1000865 Vulnerability in maven package org.kohsuke:groovy-sandbox