-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 2.73.1 | 2.73.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.74, <= 2.83 | 2.84 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing permission checks in command execution entry points. The security fix added Jenkins.RUN_SCRIPTS permission checks in constructors and deserialization (readResolve) methods of both CommandLauncher and CommandConnector. These classes handle the configuration of agent launch commands, and their pre-patch versions allowed users with just Computer.CONFIGURE permission to set arbitrary commands. The test modifications in CommandLauncher2Test.java demonstrate validation of command persistence, while the core fixes in d7ea3f4 explicitly add the permission requirements that were previously missing.