-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.xebialabs.deployit.ci:deployit-plugin | maven | <= 10.0.1 | 10.0.2 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from a form validation method (commonly named doTestConnection in Jenkins plugins) that handles connection testing to XL Deploy instances. The advisory explicitly states the method lacked proper permission checks and allowed GET requests, enabling attackers to exploit it. Jenkins plugin security patterns indicate such validation methods reside in DescriptorImpl classes, and the credential capture mechanism described aligns with this function's purpose. The fix requiring POST requests and Administer permissions further confirms this was the vulnerable entry point.
Ongoing coverage of React2Shell