-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:custom-checkbox-parameter | maven | < 1.2 | 1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from unescaped parameter names in the UI rendering. The key evidence is in the pre-patch index.jelly where ${it.name} was directly used in JavaScript initialization. The patch changed this to retrieve the value from a hidden input's val() (which HTML-escapes content), indicating the parameter name was previously rendered without proper contextual escaping. This matches the CVE description of unescaped parameter names causing XSS.