-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from a missing permission check in a form validation method. Jenkins plugins typically implement configuration validation methods using doValidate patterns in DescriptorImpl classes. The advisory explicitly mentions a form validation method with missing authorization (CWE-862) that handles connection testing. The combination of credential handling and URL validation without permission checks matches the described attack vector. The function name and location follow Jenkins plugin conventions for configuration validation handlers.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:elastest | maven | <= 1.2.1 |
Ongoing coverage of React2Shell