Unencrypted Password Storage in Jenkins Harvest SCM Plugin by Jenkins
CVE-2020-2131
6.5MEDIUM
What is CVE-2020-2131?
The Jenkins Harvest SCM Plugin versions 0.5.1 and earlier contain a vulnerability that results in the storage of passwords in an unencrypted format within the job config.xml files on the Jenkins master server. This creates a risk as users with Extended Read permissions or access to the master file system may easily view these sensitive credentials. Organizations using affected versions are encouraged to implement mitigations to secure stored passwords and reduce the risk of unauthorized access.
Affected Version(s)
Jenkins Harvest SCM Plugin <= 0.5.1