-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the preview endpoint accepting GET requests and lacking security headers. The commit shows the patched version adds @POST annotation to doPreviewDescription and introduces CSP headers, while adding a separate GET handler that blocks unsafe access. In vulnerable versions, the original doPreviewDescription method was accessible via GET requests without security headers, making it the entry point for XSS payloads when combined with unsafe markup formatters.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 2.263.1 | 2.263.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.264, <= 2.274 | 2.275 |
Ongoing coverage of React2Shell