-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient path validation in the file parameter handling logic. The commit diff shows the addition of a PROHIBITED_DOUBLE_DOT regex pattern and a modified validation check in the setUp method. The original code lacked this regex-based check for '..' sequences, making the path traversal possible. The test cases added in FileParameterValueTest.java (e.g., fileParameter_cannotCreateFile_outsideOfBuildFolder_SEC1424) explicitly validate this fix, confirming the vulnerable logic resided in the setUp method.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 2.176.1 | 2.176.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.177, <= 2.185 | 2.186 |
A Semantic Attack on Google Gemini - Read the Latest Research