Description
Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1069
http://www.securityfocus.com/bid/107790
http://www.openwall.com/lists/oss-security/2019/04/12/2
Related Vulnerabilities
CVE-2022-36919 Vulnerability in maven package org.jenkins-ci.plugins:coverity
CVE-2017-1000243 Vulnerability in maven package org.jvnet.hudson.plugins:favorite
CVE-2020-2162 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2016-1202 Vulnerability in npm package electron
CVE-2022-36893 Vulnerability in maven package org.jenkins-ci.plugins:rpmsign-plugin