Unencrypted Secret Storage in Jenkins WSO2 Oauth Plugin by Jenkins

CVE-2023-30527

Summary

The Jenkins WSO2 Oauth Plugin, when configured with versions 1.0 and earlier, poses a significant security risk as it stores the WSO2 Oauth client secret in an unencrypted format in the global config.xml file. This file resides on the Jenkins controller, making the sensitive information accessible to any user who has access to this file system. This vulnerability underscores the importance of secure handling and storage of credentials within applications, as unauthorized users may exploit this weakness to gain access to critical components of the system.

References