-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:bigpanda-jenkins | maven | <= 1.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key failures: 1) Storing the API key in plaintext via configuration serialization, and 2) Failing to mask the key in the UI. Jenkins plugins typically handle configuration through GlobalConfiguration subclasses (BigpandaGlobalNotifier) where sensitive fields should use Secret types. The configure method and getApiKey accessor would handle persistence without encryption. The Jelly UI template's lack of password masking attribute explains the visible key exposure. These patterns align with Jenkins plugin security best practices and the described vulnerability mechanisms.
Ongoing coverage of React2Shell