-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:credentials-binding | maven | <= 1.22 | 1.23 |
Miggo AIRoot Cause AnalysisThe commit diff shows the vulnerability was fixed by moving 'secretsForBuild.remove(build)' from the decorateLogger method to the close() method of the Filter inner class. This ensures secrets remain tracked until log processing finishes. The vulnerable version's premature removal in decorateLogger left secrets exposed in builds with no build steps, as there was no subsequent processing step to trigger masking after the removal. The test addition in SecretBuildWrapperTest.java confirms the issue manifested in post-build phases when no build steps were present.
JavaJavaOngoing coverage of React2Shell