-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| de.tracetronic.jenkins.plugins:ecutest | maven | <= 2.23.1 | 2.24 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from improper credential storage in ATXInstallation.xml. Jenkins plugins typically use Descriptor/configuration classes (like ATXInstallation) with XStream serialization. The functions responsible for persisting configuration data (configure()) and exposing credential fields (getCredentials()) would directly write sensitive values to disk unencrypted. The migration to 'sensitive options' in v2.24 implies these functions previously handled credentials as plain strings rather than using Jenkins' Secret class or credential APIs.
Ongoing coverage of React2Shell