-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jvnet.hudson.plugins:selection-tasks-plugin | maven | <= 1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped parameter names/descriptions in views. Jenkins plugins typically use Jelly templates for rendering UI components. The pattern matches known XSS vulnerabilities in Jenkins where parameter metadata is rendered without proper escaping. The advisory specifically identifies Script Selection task variable parameters as vulnerable, implying the rendering logic for these parameters in their Jelly templates (config.jelly) lacks output encoding. While exact code isn't available, this is the standard implementation pattern for Jenkins parameter types, and the vulnerability description directly maps to missing escape calls in these template rendering functions.
JavaJavaOngoing coverage of React2Shell