-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:vsts-cd | maven | <= 1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability explicitly involves unencrypted credentials in job config.xml files. Jenkins plugins typically store configuration via data-bound fields in builder/descriptor classes. The absence of encryption suggests the plugin directly serializes credential strings (rather than using Jenkins' Secret class or credential IDs). The high confidence comes from: 1) The CWE-311 pattern matches plaintext storage in XML 2) Jenkins plugin architecture patterns 3) Advisory confirmation that credentials are stored in job configs 4) Multiple similar vulnerabilities in other plugins involving configure() methods and data binding.