-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the View.create method's handling of form submissions. The original code (before patch) directly used req.getSubmittedForm() without ensuring the 'name' parameter matched the validated value. The commit diff shows the fix explicitly injects the validated 'name' into the submitted form data before view creation. The test case ViewSEC1871Test demonstrates how inconsistent names in form fields could bypass validation, which this function's flawed implementation allowed.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 2.278, <= 2.286 | 2.287 |
| org.jenkins-ci.main:jenkins-core | maven | < 2.277.2 | 2.277.2 |
KEV Misses 88% of Exploited CVEs- Get the report