-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.axis.jenkins.plugins.eiffel:eiffel-broadcaster | maven | >= 2.8.0, < 2.10.3 | 2.10.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from using credential ID as the sole cache key. The primary vulnerable function would be the cache lookup implementation (SigningKeyCache.get), which doesn't consider credentials store context. The secondary vulnerable function (EiffelBroadcasterConfig.getSigningKey) enables this by propagating the insecure credential ID-based lookup. The confidence is high for the cache method as it's directly mentioned in the advisory, and medium for the config method which would logically feed data to the cache based on plugin architecture patterns.