-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from a form validation endpoint that executes the 'play' command using user-specified paths. Jenkins plugin form validation methods typically follow the doCheck[FieldName] pattern in DescriptorImpl classes. The exposure occurs when building OS commands with unvalidated user input (CWE-78). The descriptor method handling the 'play command path' field validation would be responsible for constructing and executing validation commands, making it the likely injection point. The high confidence comes from the direct match between the vulnerability description and common Jenkins plugin implementation patterns for form validation.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:play-autotest-plugin | maven | <= 1.0.2 |