Jenkins Apica Loadtest Plugin Authentication Token Exposure Vulnerability

A vulnerability exists in the Apica Loadtest Plugin for Jenkins, specifically in versions through 1.10. The plugin fails to properly mask authentication tokens in the job configuration form, which could allow attackers to observe and capture these tokens. Additionally, the plugin stores these tokens unencrypted in job configuration files on the Jenkins controller, where they can be accessed by users with certain permissions or file system access.

Impact

The vulnerability increases the risk of token theft, as unmasked tokens can be easily observed and captured by an attacker.

Remediation

Users of the Apica Loadtest Plugin should update to version 1.10.1 or later, where this vulnerability has been addressed.