-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jvnet.hudson.plugins:storable-configs-plugin | maven | <= 1.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from two key failures: 1) accepting user-controlled filenames without path traversal checks, and 2) writing files to arbitrary locations by not properly constraining the target directory. Jenkins plugin patterns suggest these operations would be handled in action classes (like Action.java) and file utility classes. The first function likely handles the HTTP request to save configs, while the second processes the filename input. Both would lack validation logic to prevent escaping the intended storage directory, matching the CWE-22 description and advisory details about unrestricted filenames leading to arbitrary XML file overwrites.
KEV Misses 88% of Exploited CVEs- Get the report