-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 2.303.1 | 2.303.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.304, <= 2.314 | 2.315 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from how DirectoryBrowserSupport handled path construction in serveFile(). The pre-patch code directly used root.child(base) without checking if 'base' represented an absolute path on Windows. The added IsAbsolute check in the commit demonstrates this was the vulnerable flow. The test cases confirm absolute path handling was the root cause, and the function's logic to resolve file paths was the entry point for traversal.