-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing access control (CWE-284) in the Exclusion Plugin's administration panel. The patch introduced the getTarget method (via StaplerProxy) to enforce Jenkins.ADMINISTER checks. Before this fix, the AdministrationPanel's web endpoints (e.g., resource listing via load() and release via doRelease()) were accessible to any authenticated user, not just admins. The absence of getTarget allowed unauthorized access to these critical functions, enabling resource manipulation. The high confidence stems from the explicit permission check added in the commit and the vulnerability's description of unauthenticated resource access.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:exclusion | maven | < 0.9 | 0.9 |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report