Threats tagged 'ghsa-884f-p57j-f258'

The Jenkins ReadyAPI Functional Testing Plugin version 1.11 and earlier stores sensitive credentials such as SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files on the Jenkins controller. These credentials can be accessed by users with Item/Extended Read permission or by anyone with access to the Jenkins controller file system. Additionally, the job configuration form does not mask these credentials, increasing the risk of exposure. No fix is currently available for this vulnerability.