The HCL AppScan Azure Boards Plugin can transmit credentials and authentication tokens in cleartext when configured to connect to the AppScan server over HTTP. This cleartext transmission permits any network observer with access to the traffic path to intercept sensitive information, thereby compromising confidentiality. The flaw is identified as a Cleartext Transmission of Sensitive Information vulnerability, classified under CWE-319. The plugin itself issues a warning when HTTP is detected and recommends switching to HTTPS, but no software patch is required beyond complying with the warning.

The affected components are the HCL Software AppScan Integration with Azure Boards for ASoC & A360. No specific version range was provided in the advisory, so all deployments of the Azure Boards plugin that use HTTP to contact the AppScan server should be considered vulnerable until they are reconfigured to use HTTPS.

The CVSS score of 2.2 indicates a low overall risk, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires that the attacker intercept traffic between the plugin and the server, the likelihood of exploitation depends on network proximity; the EPSS score is not available. If the connection is over an insecure internal network or VLAN that can be tapped, the risk is higher. Adhering to the plugin's warning by switching to TLS mitigates this risk effectively.