-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:port-allocator | maven | <= 1.10 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unencrypted credential storage in config.xml files. Jenkins plugins typically use DataBound setters/getters and XML serialization for job configurations. The functions handling credential persistence (saveCredentials) and configuration serialization (DescriptorImpl.configure) would be directly responsible for writing sensitive data to disk without encryption. This matches the CWE-312 pattern and Jenkins plugin vulnerability patterns observed in similar advisories (e.g., Gogs Plugin's CVE-2019-10348). While no exact code is provided, the plugin's core credential management functions must interact with Jenkins' XML configuration system, making these high-confidence candidates.
Ongoing coverage of React2Shell