-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:dependency-track | maven | <= 3.1.0 | 3.1.1 |
Miggo AIRoot Cause AnalysisThe commit diff shows these functions were modified to add @POST annotations and permission checks (Jenkins.ADMINISTER/Item.CONFIGURE). Their pre-patch versions: 1) Accepted any HTTP method (CSRFable), 2) Lacked authorization checks, 3) Handled credential-related operations. This matches the vulnerability description of unauthorized credential capture via CSRF. The Jelly UI changes enforcing POST align with the endpoint hardening.
Ongoing coverage of React2Shell