Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml
files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system.
github.com/jenkinsci/fortify-on-demand-uploader-plugin
github.com/jenkinsci/fortify-on-demand-uploader-plugin/commit/277642040362bcc64df163bfc1ab48f7763c2853
github.com/jenkinsci/fortify-on-demand-uploader-plugin/commit/83b23662dc0ce9486b904e282bd8047496730819
jenkins.io/security/advisory/2019-10-16/#SECURITY-1433
nvd.nist.gov/vuln/detail/CVE-2019-10449