-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how secret keys were handled in the configuration form validation. The pre-patch version of doLoginCheck in S3BucketPublisher.java:1) Used StaplerRequest.getParameter() to retrieve credentials in plaintext 2) Passed raw secretKey string to ClientHelper.createClient() 3) Was accessible without POST method requirements. The commit diff shows the fix involved:1) Using Secret type for secretKey parameter 2) Adding @RequirePOST annotation 3) Converting secretKey to encrypted Secret.getPlainText(). The global.jelly changes also confirm credentials were previously transmitted via plaintext query parameters in checkUrl.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:s3 | maven | <= 0.11.4 | 0.11.5 |
JavaJavaOngoing coverage of React2Shell