Description
Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Remediation
References
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-2014
http://www.openwall.com/lists/oss-security/2020/09/16/3
Related Vulnerabilities
CVE-2023-48796 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-api
CVE-2023-34189 Vulnerability in maven package org.apache.inlong:manager-web
CVE-2016-4567 Vulnerability in npm package mediaelement
CVE-2018-17960 Vulnerability in maven package org.webjars:ckeditor
CVE-2019-1003081 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer