-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from a missing permission check in a connection test method. Jenkins plugins typically implement connection tests via doTest* methods in Descriptor classes. The advisory specifically mentions CSRF (lack of POST requirement) and missing authorization checks - both characteristics of unsecured form validation handlers. The pattern matches Jenkins' convention where DescriptorImpl classes handle global configuration and form validation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.alauda.jenkins.plugins:alauda-kubernetes-support | maven | <= 2.3.0 |
JavaJavaOngoing coverage of React2Shell