-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:veracode-scanner | maven | <= 1.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper credential storage in the global configuration file. Jenkins plugins typically use DescriptorImpl.configure to handle global settings persistence. The advisory explicitly identifies VeracodeNotifier.xml as the vulnerable file, indicating the plugin's configuration handling (likely in the descriptor) fails to use Jenkins' encrypted credentials API. A medium-confidence entry is included for a hypothetical credential-writing method based on common vulnerability patterns, though its existence isn't explicitly confirmed in sources.