-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies ChefBuilderConfiguration.DescriptorImpl#doTestConnection as the vulnerable method. The advisory states it 1) doesn't validate() request method (allowing GET-based CSRF) and 2) lacks permission checks for connection tests. This matches the CWE-352 pattern of missing anti-CSRF tokens and improper auth checks in form validation endpoints. The function name structure follows Jenkins plugin conventions (DescriptorImpl for configuration classes).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:sinatra-chef-builder | maven | <= 1.20 |