Description
Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/09/25/3
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1551
Related Vulnerabilities
CVE-2023-25763 Vulnerability in maven package org.jenkins-ci.plugins:email-ext
CVE-2022-41255 Vulnerability in maven package org.jenkins-ci.plugins:cons3rt
CVE-2019-10648 Vulnerability in maven package net.sf.robocode:robocode
CVE-2019-14772 Vulnerability in npm package verdaccio
CVE-2020-2292 Vulnerability in maven package org.jenkins-ci.plugins:release