Jenkins Aqua Security Scanner Plugin Plaintext Token Storage Vulnerability

A vulnerability exists in the Aqua Security Scanner Plugin for Jenkins, specifically in versions 3.2.8 and earlier. The plugin stores Scanner Tokens for Aqua API in an unencrypted format within job config.xml files on the Jenkins controller. This sensitive information can be accessed by users with Item/Extended Read permission or those who have access to the Jenkins controller file system.

Impact

The vulnerability allows for unauthorized access to sensitive API tokens, which could be misused to interact with Aqua's services on behalf of the user.