Description
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/04/13/3
https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992
Related Vulnerabilities
CVE-2019-10788 Vulnerability in npm package im-metadata
CVE-2022-36083 Vulnerability in npm package jose-node-cjs-runtime
CVE-2022-43404 Vulnerability in maven package org.jenkins-ci.plugins:script-security
CVE-2019-1003061 Vulnerability in maven package org.jenkins-ci.plugins:jenkins-cloudformation-plugin