-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from unsafe interpolation of the script name (${t.name}) in the confirmDelete JavaScript function. The pre-patch code passed the raw script name via onclick="confirmDelete('${t.name}'), which could contain malicious JavaScript. The fix changed this to use a data-name attribute and retrieve it via element.getAttribute('data-name'), demonstrating the original function's parameter was tainted by unescaped user input. The confirmDelete function's handling of the name parameter without sanitization directly enabled the XSS vulnerability.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:scriptler | maven | <= 3.3 | 3.4 |
Ongoing coverage of React2Shell