CVE-2019-10379: Jenkins Google Cloud Messaging Notification Plugin stores credentials in plain text

The vulnerability stems from unencrypted credential storage in the global configuration file. Jenkins plugins typically use XStream serialization for configuration persistence. The GcmPublisher class's configure method (or related persistence mechanism) would be responsible for writing configuration data to disk. Since the advisory explicitly identifies the vulnerable file (GcmPublisher.xml) and lack of encryption, the function handling configuration serialization is the root cause. The high confidence comes from the direct match between the documented vulnerable file pattern and standard Jenkins plugin architecture for configuration handling.