Description
Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/04/13/3
https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2945
Related Vulnerabilities
CVE-2019-10379 Vulnerability in maven package org.jenkins-ci.plugins:gcm-notification
CVE-2018-1000844 Vulnerability in maven package com.squareup.retrofit2:converter-jaxb
CVE-2021-21346 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2020-7751 Vulnerability in npm package pathval
CVE-2022-23913 Vulnerability in maven package org.apache.activemq:artemis-commons