-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:fortify-on-demand-uploader | maven | <= 6.0.0 | 6.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from multiple credential enumeration functions in FodGlobalDescriptor.java that lacked proper permission checks (Jenkins.ADMINISTER). The commit 28932f7 added these checks, confirming these functions were previously vulnerable. The functions directly interact with credential storage and were accessible to users with only Overall/Read permissions, enabling ID enumeration. The high confidence comes from explicit permission check additions in the patch diff and CWE-285/862 mappings.