Description
Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2022/09/21/5
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759
Related Vulnerabilities
CVE-2023-46652 Vulnerability in maven package org.jenkins-ci.plugins:lambdatest-automation
CVE-2021-34080 Vulnerability in npm package ssl-utils
CVE-2018-11758 Vulnerability in maven package org.apache.cayenne:cayenne-server
CVE-2021-41151 Vulnerability in npm package @backstage/plugin-scaffolder-backend
CVE-2023-24057 Vulnerability in maven package org.hl7.fhir.publisher:org.hl7.fhir.publisher.core