CVE-2019-10287

Name of the Vulnerable Software and Affected Versions Jenkins youtrack-plugin Plugin versions 0.7.1 and older

Description The issue concerns the storage of credentials in the global configuration file on the Jenkins master or controller. Specifically, credentials were stored unencrypted in the file org.jenkinsci.plugins.youtrack.YouTrackProjectProperty.xml, allowing users with access to the master or controller file system to view them. The plugin now stores credentials encrypted, addressing the issue.

Recommendations For Jenkins youtrack-plugin Plugin versions 0.7.1 and older, update the plugin to a version that stores credentials encrypted, as the current version stores credentials unencrypted in its global configuration file.