The vulnerability in HCL AppScan Azure Boards Plugin can expose sensitive secrets that are stored in plaintext during pipeline execution. These secrets may appear in task outputs, debug logs, environment variable dumps, or build agent scripts even though they are masked in the user interface. The exposure allows an attacker to read credentials, tokens, or other confidential data used by the pipeline, potentially enabling further attacks such as unauthorized access or privilege escalation. This flaw is categorized as an Information Disclosure weakness (CWE-522).

HCL Software’s AppScan Integration with Azure Boards for ASoC & A360 is affected. No specific version information is listed, so all deployed instances using this plugin should be examined for potential exposure.

The CVSS score of 3.8 classifies this as a medium‑severity risk. Because the EPSS value is not available, the likelihood of exploitation cannot be precisely quantified, but the vulnerability is indirectly exploitable through pipeline logs or debug output that remains accessible to users with sufficient permissions. The KEV catalog does not list this entry, indicating no confirmed exploits at present. Attackers would need access to pipeline execution data or log files to read the plaintext secrets, which is typically restricted to users with pipeline or repo permissions. The risk can be managed by limiting log visibility and ensuring that pipeline secrets are appropriately masked or removed from log output.