-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:script-security | maven | <= 1.62 | 1.63 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of dynamic expressions in method/property names. The commit adds tests demonstrating exploitation via: 1) method calls with closures returning forbidden method names, 2) property assignments with injected property names, and 3) increment/decrement operations with tainted expressions. The groovy-sandbox dependency upgrade (1.22→1.23) and test cases indicate the interceptor previously allowed evaluation of unsafe subexpressions when resolving method/property names. The core failure was in not recursively applying sandbox checks to expressions used to generate method/property identifiers.