-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:application-director-plugin | maven | <= 1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unencrypted storage of credentials in the plugin's XML configuration file. In Jenkins plugin architecture, global configuration is typically handled by a DescriptorImpl class using Stapler form binding. The configure() method is responsible for persisting configuration data, and setPassword() would be the method binding the password field from the configuration form. Since the password is stored in plaintext, these functions fail to utilize Jenkins' built-in credential encryption (e.g., Secret class) or secure credential stores. The high confidence comes from the advisory's explicit mention of the vulnerable file pattern and Jenkins plugin development conventions.
JavaJavaOngoing coverage of React2Shell