-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:role-strategy | maven | <= 3.1 | 3.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing parent permission checks in the authorization flow. The commit adds critical parent permission verification logic specifically in the hasPermission method of RoleMap$AclImpl, including new checks for ItemGroup parent permissions when handling READ/DISCOVER requests. The test cases in Security2182Test.java validate() that parent permissions are now required, confirming the vulnerability existed in this authorization pathway. The system property escape hatch further confirms this was the focal point of the security fix.
JavaJavaOngoing coverage of React2Shell