-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unencrypted storage of API tokens in Jenkins job config.xml files. Jenkins plugins typically use DataBound setters and configuration methods to handle form inputs. The advisory explicitly states the token is stored in plain text, implying the plugin's configuration handling lacks encryption. The functions identified are common patterns in Jenkins plugins for handling credentials, and the absence of Secret object usage or encryption in these methods would directly cause cleartext storage. The high confidence comes from the explicit vulnerability description matching these Jenkins plugin implementation patterns.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:sofy-ai | maven | <= 1.0.3 |
Ongoing coverage of React2Shell