description: Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.
affected:
{
product: Jenkins Parameterized Trigger Plugin
vendor: Jenkins project
versions:
lessThanOrEqual: 2.43, status: affected, version: unspecified, versionType: custom
status: unaffected, version: 2.40.1
status: unaffected, version: 2.41.1
}