Threats tagged 'ghsa-3wgg-3j4j-3f69'

Jenkins Aqua Security Scanner Plugin versions 3.2.8 and earlier store Aqua API scanner tokens unencrypted in job config.xml files on the Jenkins controller. These tokens can be accessed by users with Item/Extended Read permissions or by anyone with file system access to the Jenkins controller. This exposure risks unauthorized disclosure of sensitive tokens. No fix is currently available for this vulnerability.