Description
Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission (config.xml), or access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/07/02/7
https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1630
Related Vulnerabilities
CVE-2017-12615 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2021-26272 Vulnerability in npm package ckeditor4-dev
CVE-2020-7760 Vulnerability in maven package org.webjars.bower:codemirror
CVE-2023-46493 Vulnerability in npm package @evershop/evershop
CVE-2019-12406 Vulnerability in maven package org.apache.cxf:cxf-core