-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unencrypted credential storage in Jenkins job config.xml files. In Jenkins plugin development, credentials are typically serialized to XML via getter methods in SCM/BuildStep classes. The StarTeam Plugin's credential fields (username/password) would be exposed through methods like getUsername() and getPassword() that return plain-text values rather than encrypted Secret objects. These methods are automatically called during XML serialization, leading to plain-text storage. While no direct code is provided, this pattern matches Jenkins plugin vulnerability paradigms for CWE-522 and aligns with the advisory's description of credential exposure in config.xml files.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hudson.plugins:starteam | maven | <= 0.6.13 |
A Semantic Attack on Google Gemini - Read the Latest Research