While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Azure AD Plugin 1.1.2 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Azure AD Plugin 1.2.0 transmits the client secret in its global configuration encrypted.

Affected Packages

Maven org.jenkins-ci.plugins:azure-ad

Affected versions: 0 (fixed in 1.2.0)

Related CVEs

CVE-2020-2119

Key Information

GHSA ID

GHSA-vvg2-hg3c-mqj3

Published

May 24, 2022 5:08 PM

Last Modified

January 14, 2023 5:27 AM

CVSS Score

2.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:azure-ad

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 4, 2025 6:27 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.