-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from PasswordParameterDefinition's getDefaultValue() returning a plaintext password string. The associated Jelly template (config.jelly) used this value in a password field's 'value' attribute, exposing it in HTML source. The patch introduced getDefaultValueAsSecret() to return an encrypted Secret instead, and updated the template to use it. The pre-patch getDefaultValue() was the direct source of plaintext exposure.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 1.533, < 1.551 | 1.551 |
| org.jenkins-ci.main:jenkins-core | maven | < 1.532.2 | 1.532.2 |
Ongoing coverage of React2Shell