-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 2.340, < 2.356 | 2.356 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped HTML rendering in the build button tooltip. Jenkins uses Jelly templates for UI rendering, and the advisory specifically mentions list view tooltips as the attack vector. The fix in 2.356 involved adding HTML escaping to this component. While exact function names aren't provided in public disclosures, the Jelly template responsible for list view rendering (index.jelly) would contain the vulnerable interpolation of the job display name into the tooltip attribute without escaping.