-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure comparison of API tokens using standard string equality checks (String.equals()) which have variable execution time based on input similarity. The security advisory explicitly identifies this as SECURITY-241. While the exact code changes aren't shown, Java security best practices and Jenkins' architecture indicate the authentication flow (likely in User.authenticate()) would be the location of this comparison. The function signature matches Jenkins' package structure and authentication workflow patterns. The high confidence comes from the direct match between the vulnerability description and the standard remediation pattern (replacing String.equals() with constant-time comparison).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | < 1.650 | 1.650 |
Ongoing coverage of React2Shell