-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe advisory explicitly states the vulnerability stems from an HTTP endpoint that 1) lacks CSRF protection (no POST requirement) and 2) misses permission checks. In Jenkins plugins, connection-testing endpoints like 'doTestConnection' in DescriptorImpl classes are common attack surfaces for CSRF. The function name follows Jenkins' convention for form validation handlers, and the described attack vector (triggering SSH connections with stolen credentials) aligns with the purpose of a connection-testing endpoint.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:ssh | maven | <= 2.6.1 |