-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from missing input validation in node management operations. The commit diff shows the patched version added Jenkins.checkGoodName() validation in both addNode() and replaceNode() methods. These functions previously allowed special characters like '../' in agent names, which could be used to construct paths targeting the global config.xml. The CWE-20 (input validation) and CWE-22 (path traversal) mappings confirm this pattern. Test cases added in the commit specifically validate these code paths, demonstrating they were the attack surface.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | < 2.263.2 | 2.263.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.264, < 2.275 | 2.275 |
Ongoing coverage of React2Shell