-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key aspects: 1) The original default regex pattern lacked proper suffix handling (e.g., no '/?.*' at the end), making it vulnerable to bypass via URL manipulation. 2) The setPattern method didn't automatically detect/replace legacy vulnerable patterns. The commit introduced BypassablePatternMonitor to detect bad patterns and modified setPattern to auto-replace legacy defaults. The pattern initialization and setPattern method were directly responsible for maintaining the vulnerable regex configuration.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:audit-trail | maven | < 3.7 | 3.7 |