-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from an HTTP endpoint that 1) doesn't require POST requests (CSRF vector) and 2) lacks permission checks. In Jenkins plugin architecture, connection test endpoints typically use 'do[Action]' naming patterns. The combination of credential ID parameter handling and connection testing functionality aligns with the advisory's description of attacker-specified URLs/credentials being abused. While exact implementation details aren't available, the pattern matches Jenkins' vulnerability patterns for CSRF in form submission handlers.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:tfs | maven | <= 5.157.1 |