-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unencrypted password storage in Jenkins' global config.xml. Jenkins plugins typically serialize configuration data through getter methods in their configuration classes. The presence of a plaintext password in config.xml indicates the password field was not properly encrypted before serialization. The getPassword() method in the plugin's configuration class would be directly responsible for exposing the plaintext value to the serialization process. This pattern matches Jenkins plugin development conventions where sensitive fields require explicit encryption handling using Secret class mechanisms, which appears absent here.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:labmanager | maven | <= 0.2.8 |
KEV Misses 88% of Exploited CVEs- Get the report