CVE-2019-10414

Name of the Vulnerable Software and Affected Versions Jenkins Git Changelog Plugin versions 2.17 and earlier

Description The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master or controller. Specifically, MediaWiki and Jira passwords were stored in plain text, making them accessible to users with Extended Read permission or those with access to the master or controller file system.

Recommendations For Jenkins Git Changelog Plugin versions 2.17 and earlier, save the job configuration to overwrite existing plain text passwords with encrypted ones.