Description
Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/04/13/3
https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992
Related Vulnerabilities
CVE-2020-2109 Vulnerability in maven package org.jenkins-ci.plugins.workflow:workflow-cps
CVE-2020-8147 Vulnerability in npm package utils-extend
CVE-2023-49487 Vulnerability in maven package com.jfinal:jfinal
CVE-2020-11002 Vulnerability in maven package io.dropwizard:dropwizard-validation
CVE-2022-24847 Vulnerability in maven package org.geoserver.web:gs-web-sec-jdbc