-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability combines two key issues: 1) Missing CSRF protection on an XML processing endpoint (CWE-352), and 2) XXE vulnerability in XML parsing (CWE-611). The advisory explicitly states the endpoint doesn't require POST requests (CSRF vector) and processes XML with external entities enabled. Jenkins plugin patterns suggest these would be implemented in HTTP handler methods (do* methods in Action classes) and XML parser configuration utilities. The high confidence comes from the direct mapping between described vulnerability mechanics and standard Jenkins plugin architecture patterns.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jvnet.hudson.plugins:storable-configs-plugin | maven | <= 1.0 |
Ongoing coverage of React2Shell