-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:liquibase-runner | maven | <= 1.4.7 | 1.4.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the missing authorization check in the credential enumeration endpoint. The commit diff shows the doFillCredentialsIdItems method was modified to add permission checks (Item.EXTENDED_READ and CredentialsProvider.USE_ITEM) where none existed before. This function directly handles credential ID population in UI forms, and the lack of checks in <=1.4.7 allowed unauthorized access. The Jelly file change (adding expressionAllowed) further supports this being an endpoint-related fix.
A Semantic Attack on Google Gemini - Read the Latest Research