-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unencrypted storage of credentials in GemPublisher.xml. Jenkins plugins typically handle global configuration through a Descriptor class (GemPublisherDescriptor). The configure() method persists configuration data, and the lack of encryption in this process directly causes CWE-256. The getApiKey() method's exposure of plaintext credentials aligns with the advisory's description of credentials being viewable via filesystem access. The high confidence comes from the explicit mapping between the documented vulnerability pattern (plaintext storage in a specific XML file) and standard Jenkins plugin implementation practices.
Ongoing coverage of React2Shell
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| net.arangamani.jenkins:gem-publisher | maven | <= 1.0 |