-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | < 1.532.2 | 1.532.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 1.533, < 1.551 | 1.551 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure session ID generation in Jenkins' Winstone servlet container. The fix commit 29351af4bd01f61715418916fc12c52be46bd9b0 shows the critical change from Random to SecureRandom in SessionIdManager's generateSessionId method. This matches the CVE description of session hijacking via weak session identifiers. The direct correlation between the vulnerability description, security advisory reference to Winstone, and cryptographic weakness in session ID generation provides high confidence in this assessment.
Ongoing coverage of React2Shell