-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key aspects: 1) File existence checking via form validation (doCheckKeyStoreFile) that leaked filesystem information through error messages, and 2) Direct filesystem access to read PKCS#12 certificates (getKeyStoreBytes). The commit diff shows removal of file path validation logic and migration from FileOnMasterKeyStoreSource to UploadedKeyStoreSource, confirming these were the vulnerable components. The CWE-200 and CWE-538 mappings align with these file access patterns exposing sensitive information.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:credentials | maven | <= 2.1.18 | 2.1.19 |