Jenkins Apica Loadtest Plugin Authentication Token Storage Vulnerability

A vulnerability exists in the Apica Loadtest Plugin for Jenkins, specifically in versions through 1.10. The plugin stores authentication tokens unencrypted in job configuration files on the Jenkins controller. These tokens can be accessed by users with Item/Extended Read permission or those who have access to the Jenkins controller file system.

Impact

The vulnerability allows for unauthorized access to sensitive authentication tokens, which could be misused to gain unauthorized access or perform actions on behalf of the user.