-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing X-Frame-Options headers in REST API responses. The commit diff shows the security patch added this header in the setHeaders method of hudson.model.Api class. Since this method is responsible for setting response headers, its pre-patch version (without X-Frame-Options) directly enabled the clickjacking vulnerability. The added tests in ApiSEC1704Test.java validate() that endpoints now return this header, confirming the function's role.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 2.204.1 | 2.204.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.205, <= 2.218 | 2.219 |
JavaJavaOngoing coverage of React2Shell