-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from incorrect authorization checks in credential enumeration endpoints. The commit diff shows both functions were modified to replace a simple Item.CONFIGURE check with more granular permission checks (ADMINISTER for global, EXTENDED_READ+USE_ITEM for projects). The original implementations' use of Item.CONFIGURE allowed attackers with that permission (which is broader than required) to access credential IDs. The added test cases in Security2254Test.java validate that proper permissions are now required, confirming these were the vulnerable endpoints.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:config-file-provider | maven | <= 3.7.0 | 3.7.1 |
Ongoing coverage of React2Shell