Jenkins AsakusaSatellite Plugin API Key Masking Vulnerability

A vulnerability exists in the Jenkins AsakusaSatellite Plugin in versions through 0.1.1, where the plugin fails to mask AsakusaSatellite API keys in the job configuration form. This oversight increases the risk of exposure, allowing potential attackers to observe and capture the API keys. Additionally, the plugin stores these keys unencrypted in job configuration files on the Jenkins controller, where they can be accessed by users with Item/Extended Read permission or through the Jenkins controller file system.

Impact

The vulnerability allows for the unmasked display and unencrypted storage of AsakusaSatellite API keys, which can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.