Threats tagged 'ghsa-3c9f-c64m-h4wc'

The Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier store the AWS Secret Key unencrypted in a global configuration XML file on the Jenkins controller. This key is accessible to users with file system access to the controller. Additionally, the plugin's configuration form does not mask the key, increasing the risk of exposure. No fix is currently available for this vulnerability.