Jenkins Report Portal Plugin allows users with Item/Extended Read permission to view tokens on Jenkins controller
Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.Additionally, the configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.