-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Jenkins serving user-controlled files through DirectoryBrowserSupport without adequate XSS protections. The patch adds CSP headers in the serveFile() method to mitigate this. The commit diff shows CSP headers were added precisely in this function when serving files, indicating it was the missing security control that enabled the XSS vulnerability. The test case added in DirectoryBrowserSupportTest.java verifies CSP header implementation, further confirming this function's role in the vulnerability.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 1.626, < 1.640 | 1.640 |
| org.jenkins-ci.main:jenkins-core | maven | < 1.625.2 | 1.625.2 |