Jenkins ByteGuard Build Actions Plugin API Token Storage Vulnerability

A vulnerability exists in the Jenkins ByteGuard Build Actions Plugin in versions through 1.0, where API tokens are stored unencrypted in job config.xml files on the Jenkins controller. This exposure allows users with Item/Extended Read permission or access to the Jenkins controller file system to view these tokens. Additionally, the job configuration form does not mask these credentials, further increasing the risk of unauthorized observation and capture.

Impact

The unencrypted storage of API tokens in job config.xml files on the Jenkins controller creates a risk of unauthorized access to these tokens by users with Item/Extended Read permission or file system access.