Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
| Vendor | Product | Versions |
|---|---|---|
| jenkins | loadninja | < 2.2 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| jenkins | jenkins | cert_advisory | 90% |
| red hat | red hat enterprise linux | cert_advisory | 90% |
