-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the User.java's getAllProperties() method returning user properties without proper authorization checks. The commit diff shows this method was modified to add a Jenkins.ADMINISTER permission check, confirming the original implementation lacked access control. This matches the advisory's description of exposing user details via /user/(username)/api to non-admins. The test case addition in UserTest.java further validates the security boundary was enforced at this method.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 2.73.1 | 2.73.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.74, <= 2.83 | 2.84 |
JavaJavaOngoing coverage of React2Shell