-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:azure-keyvault | maven | < 188.vf46b | 188.vf46b |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper credential masking in Jenkins' push mode logging (DurableTaskStep.USE_WATCHING). Key functions would be those handling: 1) Secret retrieval from Azure Key Vault 2) Logging during pipeline step execution. The AzureKeyVaultStepExecution.run() is the most likely location where retrieved secrets enter the build context and could be logged unmasked. AzureCredentialsProvider.getCredentials() is implicated as the source of credential exposure if not properly wrapped for masking. Confidence is medium due to lack of direct patch code, but grounded in Jenkins' credential handling patterns and the advisory's technical details about push mode logging being the trigger.