-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | < 2.263.2 | 2.263.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.264, <= 2.274 | 2.275 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) FileFingerprintStorage.load() lacked validation of fingerprint ID format before building filesystem paths, enabling directory traversal. 2) FingerprintMap.toByteArray() used custom hex parsing that didn't enforce proper MD5 format. The commit fixes show the vulnerability was addressed by adding hex validation (Util.fromHexString) in both the load method and fingerprint creation path. The test cases demonstrate how unvalidated IDs could be manipulated to access files outside the intended directory structure.
Ongoing coverage of React2Shell