-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unencrypted credential transmission in job configuration forms. Jenkins plugins typically handle form submissions through methods like configSubmit in SCM implementations and configure in Descriptor classes. The advisory explicitly states credentials are transmitted in plain text during configuration, implicating these form-handling functions. The high confidence comes from: 1) Standard Jenkins plugin architecture patterns for form handling 2) The CWE-319 classification matching plaintext transmission scenarios 3) The vulnerability description specifically calling out job configuration forms as the exposure vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:vault-scm-plugin | maven | <= 1.1.1 |
Ongoing coverage of React2Shell