-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:periodicbackup | maven | <= 1.4 | 1.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing permission checks (CWE-862) and CSRF protections in API endpoints. Jenkins plugin endpoints typically use do[Action] methods for HTTP handlers. The advisory explicitly mentions: 1) Lack of permission checks for critical operations, 2) Missing POST method requirements. The functions listed handle configuration changes, backup operations, and file management - all explicitly mentioned vulnerable surfaces. High confidence comes from Jenkins' security patterns where do* methods without @RequirePOST/checkPermission() are known risks. The BackupManager.deleteBackupFiles gets medium confidence as log rotation-triggered deletion is specifically mentioned but requires deeper code analysis.