-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:pipeline-githubnotify-step | maven | < 1.0.5 | 1.0.5 |
Miggo AIRoot Cause AnalysisThe advisory explicitly mentions two critical flaws: 1) Missing permission checks on form validation methods, and 2) CSRF vulnerability due to lack of POST requirement. In Jenkins plugin architecture, form validation is typically handled by 'doCheck*' methods in DescriptorImpl classes. The credential ID parameter handling and URL validation would logically reside in these methods. The combination of missing CSRF tokens (GET instead of POST) and absent permission checks in these validation endpoints aligns with the described attack vector where attackers manipulate these parameters to exfiltrate credentials.
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report