-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper output encoding in Repository URL field validation. Jenkins plugins typically implement form validation through doCheck[FieldName] methods in Descriptor classes. The advisory specifically mentions unescaped error messages during form validation, which aligns with the pattern where FormValidation.error() methods return raw user input without proper escaping. The high confidence comes from: 1) The vulnerability description explicitly mentioning form validation for Repository URL 2) Standard Jenkins plugin development patterns for form validation 3) The XSS attack vector requiring unvalidated error message rendering
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jvnet.hudson.plugins:svn-release-mgr | maven | <= 1.2 |