-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from improper escaping in views, which in Jenkins plugins are typically implemented as Jelly templates. While the advisory doesn't provide exact code locations, the pattern of stored XSS in Jenkins plugins often involves unescaped ${variable} interpolation in Jelly files. The medium confidence reflects the lack of explicit code examples, but the described vulnerability pattern strongly suggests view rendering functions handling user-configurable pipeline parameters are the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:build-pipeline-plugin | maven | <= 1.5.8 |
Ongoing coverage of React2Shell