Jenkins Curseforge Publisher Plugin API Key Storage Vulnerability

A vulnerability exists in the Jenkins Curseforge Publisher Plugin in versions through 1.0, where API keys are stored unencrypted in job config.xml files on the Jenkins controller. This exposure allows users with Item/Extended Read permission or access to the Jenkins controller file system to view the keys. Additionally, the job configuration form does not mask these keys, increasing the risk of unauthorized observation and capture.

Impact

The unencrypted storage of API keys in accessible job configuration files could lead to unauthorized access or actions on behalf of the user whose key is compromised.