-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from an HTTP endpoint handling SSH connection testing that lacks authorization checks. Jenkins plugins typically implement such endpoints via Descriptor classes with do* methods (e.g., doTestConnection). The advisory explicitly states attackers can specify credentials/SSH servers through an endpoint, which matches this pattern. The absence of permission checks (like Jenkins.get().checkPermission(CredentialsProvider.USE_ITEM)) in this method would allow the described exploit. While exact implementation details aren't available, this matches Jenkins plugin vulnerability patterns and the CWE-862 description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:ssh | maven | <= 2.6.1 |
JavaJavaOngoing coverage of React2Shell