-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:script-security | maven | <= 1.70 | 1.71 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two main issues: 1) The GroovyCallSiteSelector.method() function failed to intercept method calls on GroovyInterceptable objects, allowing attackers to bypass sandbox checks by invoking arbitrary methods. 2) The absence of critical constructor blacklist entries in StaticWhitelist permitted direct instantiation of synthetic wrapper constructors, enabling sandbox escape via crafted super constructor calls. Both issues were explicitly addressed in the patch (SECURITY-1754), confirming their role in the vulnerability.