-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped filenames in jobMain.jelly. The Jelly template accesses S3Artifact entries and outputs their names via ${entry.name}, which invokes S3Artifact.getName(). In the unpatched version, this value was not escaped, making the getName() method the source of untrusted data. The runtime profiler would capture this method when filenames are processed for UI rendering, as it's the origin of the payload before unsafe output occurs.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:s3 | maven | <= 0.10.12 | 0.11.0 |