This advisory announces a vulnerability in the SAML Plugin.
The SAML Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins controller local file system access and Jenkins administrators to retrieve the stored password. The latter could result in exposure of the passwords through browser extensions, cross-site scripting vulnerabilities, and similar situations.
The SAML Plugin now stores passwords encrypted, and only transfers encrypted values as part of the configuration form after the initial configuration.