-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jvnet.hudson.plugins:speaks | maven | <= 0.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper permission checks when executing Groovy code. The Speaks! Plugin's core functionality involves executing speech synthesis logic, which appears to have exposed a Groovy execution endpoint. The 'perform' method in notifier classes is typically where Jenkins plugins implement build/post-build actions. Given the advisory explicitly states Job/Configure users can execute arbitrary code, this function would be the logical entry point for processing user-controlled scripts without enforcing the stricter Overall/Run Scripts permission requirement (CWE-732). The confidence is high because this pattern matches Jenkins plugin vulnerability patterns and the advisory's technical description.