-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 2.73.1 | 2.73.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.74, <= 2.83 | 2.84 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper access control in the Executor class's API exposure. The commit diff shows removal of @Exported from getCurrentExecutable() and introduction of a replacement method getCurrentExecutableForApi() with permission checks. The original method lacked authorization validation, directly mapping to the CWE-200 description of exposing sensitive information. The test case added in ExecutorTest.java confirms the security check was missing for currentExecutable in API responses.