-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 2.304, <= 2.318 | 2.319 |
| org.jenkins-ci.main:jenkins-core | maven | <= 2.303.2 | 2.303.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing access control rules in the Jenkins file path filtering configuration (filepath-filter.conf), not from specific code functions. The core issue was that the built-in rules allowed agent access to the <BUILDDIR>/libs directory by default, which was addressed by adding explicit deny rules in the configuration file. The advisory and commit diff show the fix was purely configuration-based, modifying path filtering rules rather than patching specific functions. While the FilePath APIs are mentioned as the attack vector, the vulnerability arises from the absence of restrictions in the security policy configuration, not from flawed implementations of individual functions. No specific code functions are identified in the provided data as directly vulnerable with high confidence.
Ongoing coverage of React2Shell