-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unencrypted storage of LDAP credentials in Jenkins' global config.xml. Jenkins plugins typically use XStream for configuration serialization. The ReverseProxySecurityRealm class and its descriptor would contain the password field handling. Since the advisory explicitly mentions the password is stored unencrypted in config.xml, these configuration persistence functions are directly responsible for writing sensitive data without encryption. The high confidence comes from the vulnerability pattern matching Jenkins plugin configuration handling mechanics, even without direct access to the exact code diff.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:reverse-proxy-auth-plugin | maven | >= 1.7.3, < 1.7.4 | 1.7.4 |
Ongoing coverage of React2Shell