-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from password parameters exposing default values in the DOM. The PasswordParameterDefinition class handles parameter storage, and its getDefaultValue() method provides the cleartext value. The associated Jelly template (config.jelly) would render this value into the page's HTML. Both components are directly involved in the exposure mechanism - the Java method provides the sensitive data, and the template renders it unsafely. The patch would need to modify both the data access (to restrict unauthorized retrieval) and the rendering logic (to prevent DOM exposure).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 1.566, < 1.583 | 1.583 |
| org.jenkins-ci.main:jenkins-core | maven | < 1.565.3 | 1.565.3 |
A Semantic Attack on Google Gemini - Read the Latest Research