-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:script-security | maven | <= 1.62 | 1.63 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper sandbox validation of property names in assignment operations and increment/decrement expressions. The commit patching this (b28e4dc) adds tests demonstrating these bypass scenarios (blockPropertyNameInAssignment, blockPropertyNameInPrefixPostfixExpressions). The groovy-sandbox dependency upgrade (1.22→1.23) indicates fixes in expression evaluation logic. The vulnerable functions are core sandbox components handling property assignments and expression evaluation, which previously allowed malicious property name manipulation to bypass security checks.
Ongoing coverage of React2Shell