-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from three key behaviors: 1) The SecretRewriter's backup file copy operation (now removed in patch) wrote sensitive data to world-readable backups. 2) The SecretRewriter constructor established the backup directory path that enabled this behavior. 3) The RekeySecretAdminMonitor initialized the backup infrastructure without proper cleanup. The commit diff shows removal of backup-related code in SecretRewriter and added deletion in RekeySecretAdminMonitor, confirming these were the vulnerable paths. The functions directly handling backup creation/retention without proper permissions match the CWE-200 description of exposing sensitive data.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 1.498, <= 2.32.1 | 2.32.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.40, <= 2.43 | 2.44 |