-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jvnet.hudson.plugins:warnings | maven | <= 5.0.1 | 5.0.2 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from a form validation endpoint for custom warnings parsers that didn't enforce POST requests. In Jenkins plugin architecture, form validation methods are typically named 'doCheck*' in Descriptor classes. The advisory specifically mentions the incomplete fix for SECURITY-1295 (CSRF) and the requirement to add POST enforcement in 5.0.2. This pattern matches Jenkins' security practices where @RequirePOST annotations are used to prevent CSRF, and their absence would make such methods vulnerable.