-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped parameter name/description fields in UI views. Jenkins plugins typically implement parameter rendering via Jelly templates in config.jelly files. The advisory explicitly states the plugin fails to escape these fields, matching the pattern seen in other parameter XSS vulnerabilities (CWE-79). While exact code isn't available, the standard Jenkins parameter implementation pattern and vulnerability description strongly indicate the Jelly view templates for VBoxNodeParameter are the vulnerable component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:vboxwrapper | maven | <= 1.3 |
JavaJavaOngoing coverage of React2Shell