CVE-2019-10297: Jenkins Sametime Plugin stores credentials in plain text

The vulnerability stems from the plugin storing credentials in plain text in its global configuration file. Jenkins plugins typically use XStream for serialization/deserialization of configuration data. The SametimePublisher class (evident from the XML filename) would contain methods like configure() for saving settings and readResolve() for loading them. Since credentials are stored unencrypted, these methods fail to use Jenkins' Secret class or encryption mechanisms when handling sensitive data. The high confidence comes from the direct mapping between the disclosed vulnerable file pattern and standard Jenkins plugin implementation practices for configuration handling.