-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key elements: 1) The password field was declared as a String type rather than Jenkins' secure Secret type, allowing plaintext storage. 2) The getRepoPassword() method exposed the plaintext value directly. The commit diff shows both the field type change (String→Secret) and the getter modification to use Secret.getPlainText(), confirming these were the vulnerable points. The CWE-256 classification (plaintext storage) directly maps to these implementation choices.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.parasoft:environment-manager | maven | < 2.15 | 2.15 |
JavaJavaOngoing coverage of React2Shell