Jenkins Dead Man's Snitch Plugin Token Exposure Vulnerability

A vulnerability in the Dead Man's Snitch Plugin for Jenkins, specifically version 0.1, allows for the unmasked display of Dead Man's Snitch tokens in the job configuration form. This oversight increases the risk of token exposure to potential attackers. Additionally, the plugin stores these tokens in plain text within the job 'config.xml' files on the Jenkins controller, making them accessible to users with Item/Extended Read permission or those who can access the Jenkins controller file system.

Impact

The vulnerability could lead to unauthorized observation and capture of Dead Man's Snitch tokens, which are stored in plain text and unmasked in the job configuration form.