-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:shelve-project-plugin | maven | <= 3.0 | 3.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing HTTP method restrictions on critical endpoints. The commit 5cb9a47 explicitly adds @POST annotations to these two methods, which matches the advisory's description of 'requiring POST requests for affected endpoints' as the fix. Both methods handle destructive operations (shelve/unshelve/delete) and were vulnerable to CSRF when accepting any HTTP method.