Jenkins Kryptowire Plugin Plain Text API Key Storage Vulnerability

A vulnerability exists in the Jenkins Kryptowire Plugin in versions through 0.2, where the Kryptowire API key is stored unencrypted in a global configuration file on the Jenkins controller. This key can be accessed by users with permission to view the Jenkins controller file system.

Impact

The vulnerability allows for unauthorized access to the Kryptowire API key, which could be misused if the key provides access to sensitive functionalities or data within the Kryptowire service.