-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Jenkins' default markup formatter policy (MyspacePolicy) improperly allowing <form> tags with action attributes pointing to external URLs. The advisory explicitly references MyspacePolicy's permissive configuration with tag("form", "action", ONSITE_OR_OFFSITE_URL, "method"), which failed to properly restrict form submission targets. This allowed attackers to inject phishing forms via the user Description field, which would render persistently in user profiles. The file path is inferred from Jenkins' standard security policy implementation structure.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 1.523 |