CVE-2019-10416

Name of the Vulnerable Software and Affected Versions Jenkins Violation Comments to GitLab Plugin version 2.28 and earlier

Description The issue concerns the storage of credentials in an unencrypted manner. Specifically, the Violation Comments to GitLab Plugin stored API tokens unencrypted in job config.xml files and its global configuration file org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Recommendations For Jenkins Violation Comments to GitLab Plugin version 2.28 and earlier, save the job configuration to overwrite existing plain text credentials with encrypted ones, as the plugin now stores credentials encrypted.