-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from three key issues in API endpoints: 1) Missing POST requirement (allowing CSRF via GET), 2) Reliance on a global secret instead of Jenkins' permission system, and 3) Lack of Agent/Configure checks. The commit diff shows these functions were modified to add @POST annotations, remove secret parameters, and introduce nn.checkPermission(Computer.CONFIGURE). The pre-patch versions of these functions in PluginImpl.java contained the vulnerable pattern of using secret-based auth without CSRF protections or proper permission validation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:swarm | maven | < 3.21 | 3.21 |
A Semantic Attack on Google Gemini - Read the Latest Research