Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file hudson.plugins.jira.JiraProjectProperty.xml
on the Jenkins master. These credentials could be viewed by users with access to the Jenkins master file system.
jira-ext Plugin version 0.9 stores credentials encrypted.
{ "nvd_published_at": "2019-04-18T17:29:00Z", "cwe_ids": [ "CWE-256", "CWE-522" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-05-19T23:46:18Z" }