-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jvnet.hudson.plugins:findbugs | maven | <= 5.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped annotation messages in tooltips. The FindBugsPublisher#perform method is the entry point for processing reports, making it responsible for handling raw data. BugAnnotation#getMessage provides the untrusted message content. In Jenkins plugin patterns, these components would feed data to views (Jelly/Groovy templates) that render tooltips. Without HTML escaping during either data storage (perform) or retrieval (getMessage), the XSS payload persists through the pipeline. The correlation with similar CVE-2020-2316 in analysis-core (same symptom) reinforces this pattern.