-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:zulip | maven | < 1.1.1 | 1.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from handling credentials as plain text strings rather than encrypted secrets. Key evidence includes: 1) The API key field type changed from String to Secret in DescriptorImpl 2) Configuration loading/saving was modified to use Secret.fromString/Secret.toString 3) Constructor parameters were updated to accept Secret type 4) Test cases were updated to handle Secret objects. The pre-patch versions of these functions handled credentials in plain text form, making them the vulnerable points.
JavaJavaOngoing coverage of React2Shell