-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability centers on a form validation method with two critical flaws: 1) Missing permission check allowing low-privilege users (Overall/Read) to execute it, and 2) Lack of POST request requirement enabling CSRF. In Jenkins plugins, form validation methods typically follow the 'doCheck[ParameterName]' naming pattern and reside in Descriptor/Publisher classes. The credential testing functionality described aligns with JDBC connection validation, pointing to a method like doCheckJdbcUrl in the Maven JDBC publishing component. The high confidence comes from the vulnerability pattern matching Jenkins plugin security best practices - form validation methods require POST and specific permissions, which were explicitly added in the patched version.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:pipeline-maven | maven | < 3.8.3 | 3.8.3 |
JavaJava