The Jenkins FitNesse Plugin up to version 1.36 has a vulnerability where passwords are stored in plaintext within job config.xml files on the Jenkins controller. This allows users who have Extended Read permission or file system access to the Jenkins controller to view these passwords. No CVSS score or official remediation information is provided, and no known exploits in the wild have been reported.

Passwords stored unencrypted in configuration files can be accessed by users with Extended Read permission or by anyone with file system access to the Jenkins controller. This exposure risks credential compromise, potentially leading to unauthorized access to Jenkins jobs or other systems relying on these credentials.

Patch status is not yet confirmed — check the Jenkins Project advisory for current remediation guidance. Until a fix is available, restrict Extended Read permissions to trusted users only and limit file system access to the Jenkins controller to prevent unauthorized viewing of stored passwords.