Description
Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1551
http://www.openwall.com/lists/oss-security/2019/09/25/3
Related Vulnerabilities
CVE-2020-11022 Vulnerability in maven package org.webjars:jquery
CVE-2023-28155 Vulnerability in maven package org.webjars.bower:request
CVE-2016-0750 Vulnerability in maven package org.infinispan:infinispan-client-hotrod
CVE-2022-3145 Vulnerability in npm package @okta/oidc-middleware
CVE-2023-33831 Vulnerability in npm package @frangoteam/fuxa