Assembla Plugin stores the Assembla password unencrypted in its global configuration file jenkins.plugin.assembla.AssemblaProjectProperty.xml
on the Jenkins controller. This password can be viewed by users with access to the Jenkins controller file system.
As of publication of this advisory, there is no fix.