The vulnerability stems from unencrypted storage of Jira credentials in the global configuration file. Jenkins plugins typically use a Descriptor class (e.g., ZAPBuilder.DescriptorImpl) to manage global settings, which are serialized to XML. The advisory explicitly identifies the file org.jenkinsci.plugins.zap.ZAPBuilder.xml as the vulnerable artifact. Since Jenkins provides a secure Credentials API for encrypted storage, the absence of its usage in these configuration-handling functions directly enables the plaintext exposure. The high confidence stems from the explicit file path/class structure mentioned in advisories and standard Jenkins plugin architecture patterns.