-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing or incorrect permission checks in HTTP endpoint handlers. The commit diff shows these methods lacked Item.BUILD checks (added in the patch) and used weaker permissions (e.g., AbstractProject.BUILD). The advisory confirms attackers with Overall/Read could exploit these endpoints. TagAction.doSubmit had a permission check (PerforceScm.TAG), but the form's GET method allowed CSRF; however, the primary issue was missing authorization in the listed functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:p4 | maven | < 1.10.11 | 1.10.11 |