-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key flaws: 1) Unencrypted storage of API keys in XML config files, and 2) Cleartext transmission in configuration forms. Jenkins plugin architecture indicates configuration handling occurs in Notifier classes and their Descriptors. The OpsGenieNotifier class would handle job-level configuration (storing keys in job config.xml), while its DescriptorImpl manages global configuration (OpsGenieNotifier.xml). The configure methods process form data without encryption, and getApiKey() likely returns raw keys for form display. These functions align with the described attack vectors (file system exposure and form transmission).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:opsgenie | maven | <= 1.9 |
A Semantic Attack on Google Gemini - Read the Latest Research