CVE-2019-10415

Name of the Vulnerable Software and Affected Versions Jenkins Violation Comments to GitLab Plugin version 2.28 and earlier

Description The issue concerns the storage of credentials in an unencrypted manner. Specifically, the plugin stored API tokens unencrypted in job config.xml files and its global configuration file org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with Extended Read permission or access to the Jenkins controller file system.

Recommendations For Jenkins Violation Comments to GitLab Plugin version 2.28 and earlier, update the plugin to a version that stores credentials encrypted. Additionally, for existing jobs, save their configuration to overwrite existing plain text credentials with encrypted ones.