-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key flaws: 1) In hudson-behavior.js, crumbs were added to URL parameters for all forms, including multipart ones, rather than the request body. This allowed CSRF bypass as attackers could omit the crumb from the body. 2) CrumbFilter.java explicitly excluded multipart requests from validation. The fix in ba74788 added enctype checks in the JavaScript, while ef2c0dc removed the multipart exemption in the Java filter. Both functions directly contributed to the CSRF bypass mechanism.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 1.626, < 1.640 | 1.640 |
| org.jenkins-ci.main:jenkins-core | maven | < 1.625.2 | 1.625.2 |