-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:github-pr-coverage-status | maven | <= 2.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from plaintext storage of credentials in the plugin's XML configuration file. Jenkins plugins typically use getter methods in configuration classes to serialize data, and a DescriptorImpl class to handle configuration persistence. The identified functions directly handle the sensitive fields without encryption during serialization/persistence, matching the CWE-256/CWE-312 patterns described. While no patch is available to confirm, this structure aligns with standard Jenkins plugin architecture and the advisory's technical details.
A Semantic Attack on Google Gemini - Read the Latest Research