Description
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.
Remediation
References
Related Vulnerabilities
WordPress Plugin Issuu Panel Local/Remote File Inclusion (1.6)
WordPress Plugin WP Editor Multiple Vulnerabilities (1.2.5.3)
WordPress Plugin Print-O-Matic Cross-Site Scripting (2.1.7)
MySQL CVE-2020-2930 Vulnerability (CVE-2020-2930)
LimeSurvey Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-16397)