-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unencrypted storage of access tokens in Jenkins job config.xml files. Jenkins plugins typically use DataBound constructors and getter/setter methods to persist configuration data. If the plugin's DingdingBuilder class accepts and stores the token as a plain String (instead of using Jenkins' Secret class), and exposes it via getters, this would directly cause the plaintext storage vulnerability. The lack of encryption in storage and masking in UI aligns with the described CWE-312 (cleartext storage) and advisory details about config.xml exposure.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.zintow:dingding-json-pusher | maven | <= 2.0 |