-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:token-macro | maven | <= 2.7 | 2.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parsing in the ReadXML class's call() method. The pre-patch code used DocumentBuilderFactory.newInstance() without security hardening, leaving XXE protections disabled. The commit diff shows the vulnerability was fixed by: 1) Introducing a createFactory() method that disables dangerous XML features 2) Setting secure processing attributes 3) Adding a null EntityResolver. The original implementation lacked these protections, making the call() method the vulnerable entry point for XXE attacks when processing XML files with the ${XML} macro.