CVE-2020-2318: Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin

The vulnerability explicitly describes plaintext password storage in job config.xml files. Jenkins plugins typically serialize job configuration data using XStream, which writes field values directly unless explicitly protected. The absence of encryption implies the password field was declared as a String (not Secret) and lacked @Secret annotations or proper handling. While the exact class/method names are unavailable without source code, the root cause lies in the serialization logic of password fields in configuration classes, a common pattern in Jenkins plugins. This matches CWE-256 (plaintext storage) and CWE-522 (insufficient credential protection).