CVE-2026-21812: Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)
HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the plugin to communicate with the AppScan server over HTTPS instead of HTTP.
HCL AppScan Azure Boards Plugin AppScan server communication protocol = HTTPS
Event History
Frequently Asked Questions
Which deployments are exposed to credential or token interception?
Deployments where the HCL AppScan Azure Boards Plugin is configured to communicate with the AppScan server over HTTP are exposed. The issue concerns sensitive information transmitted through that unencrypted connection.
What must an attacker be able to do to exploit this issue?
An attacker would need to be able to intercept traffic between the plugin and the AppScan server while credentials or authentication tokens are being transmitted over HTTP. The provided severity vector also indicates high attack complexity and required privileges.
What can be done if the plugin cannot be updated immediately?
Configure communication with the AppScan server to use HTTPS rather than HTTP. The update adds a warning for HTTP use and recommends HTTPS for secure communication.