-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from SCM checkout implementations that didn't validate() against local file paths when running on Jenkins controllers. The commit diffs show all three plugins added explicit checks (abortIfUrlLocal/abortIfSourceIsLocal) in their checkout() methods to block file:// URLs and local paths. The vulnerable functions are the original checkout implementations before these security checks were added. High confidence comes from: 1) CVE description explicitly mentioning controller-side checkouts, 2) Patch commits adding validation logic directly to checkout workflows, 3) Test cases validating the blocking of local paths in checkout operations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:repo | maven | < 1.14.1 | 1.14.1 |
| org.jenkins-ci.plugins:mercurial | maven | < 2.16.1 | 2.16.1 |
| org.jenkins-ci.plugins:git | maven | < 4.11.2 | 4.11.2 |
A Semantic Attack on Google Gemini - Read the Latest Research