-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:dependency-check-jenkins-plugin | maven | <= 5.1.1 | 5.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parsing in ReportParser.java. The patch adds critical security features (disallow-doctype-decl, external-entity restrictions) to the Digester configuration within the parse() method. The pre-patch code lacked these protections, making this function the entry point for XXE exploitation. The added test case specifically validates rejection of external entities in XML parsing, confirming this function's role in the vulnerability.
Ongoing coverage of React2Shell