-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:qmetry-for-jira-test-management | maven | <= 1.13 | 1.14.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from password fields being handled as plain text in configuration forms. The commit diff shows critical changes: (1) Password fields were migrated from String to Jenkins' Secret type, (2) getters/setters were modified to avoid decryption during form rendering, and (3) authentication logic in UploadToServer was updated to use Secret.getPlainText() instead of raw strings. The original functions transmitted passwords as plain text because they used String types for sensitive data, allowing exposure via browser DOM, XSS, or network interception. The high confidence stems from explicit code changes addressing cleartext transmission in the patched commit.
Ongoing coverage of React2Shell