-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:cobertura | maven | <= 1.15 | 1.16 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parser configurations in two key locations:
CoberturaCoverageParser.java's SAX parser lacked critical XXE protection features (added in the patch via setFeature calls).CoberturaPublisher.java's StAX parser had incomplete DTD/external entity disabling (patched by switching to standard SUPPORT_DTD property and adding explicit external entity disablement). Both functions directly handle XML parsing of user-controlled input without proper safeguards in vulnerable versions, matching the CWE-611 XXE vulnerability pattern.