-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:warnings-ng | maven | <= 5.0.0 | 5.1.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped rendering of custom parser names in Jenkins UI. The changelog explicitly mentions adding escaping for parser names in 5.1.0. The getName() method on the CustomParser class would be the source of the unvalidated output, as it provides the raw parser name to Jelly views. During exploitation, this method would appear in stack traces when malicious parser names are processed and rendered without sanitization.
Ongoing coverage of React2Shell