-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from three form validation methods in IceScrumProjectProperty's DescriptorImpl. While they had @RequirePOST annotations (mandating POST requests), they lacked Jenkins.ADMINISTER permission checks prior to the patch. This allowed two attack vectors: 1) Users with lower privileges (Overall/Read) could be CSRF'd into triggering these actions, and 2) The absence of permission checks meant even properly authenticated non-admin users could abuse these endpoints. The commit 2e248f7 explicitly added the missing permission checks, confirming these were the vulnerable entry points.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:icescrum | maven | < 1.1.6 | 1.1.6 |
Ongoing coverage of React2Shell