-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from improper credential storage in TestLinkBuilder's global configuration. Jenkins plugins typically use the Credentials API for secret management, but the advisory explicitly states credentials are stored unencrypted in TestLinkBuilder.xml. This implies the plugin's configuration persistence layer (configure()/save() methods in TestLinkBuilder and its DescriptorImpl) directly serializes credential fields without encryption. The file path and class structure follow Jenkins plugin conventions, and the CWE-522 classification confirms insufficient credential protection at the code level.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:testlink | maven | <= 3.16 |
Ongoing coverage of React2Shell