Description
Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.
Remediation
References
https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1975
http://www.openwall.com/lists/oss-security/2020/08/12/4
Related Vulnerabilities
CVE-2014-3661 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2017-5929 Vulnerability in maven package ch.qos.logback:logback-core
CVE-2018-12538 Vulnerability in maven package org.eclipse.jetty:jetty-server
CVE-2022-0624 Vulnerability in maven package org.webjars.npm:parse-path
CVE-2022-26112 Vulnerability in maven package org.apache.pinot:pinot-broker