-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:pipeline-input-step | maven | < 449.v77f0e8b | 449.v77f0e8b |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) The InputStep allowed specification of 'file' parameters via its parameter descriptor logic (getParametersDescriptors), and 2) InputStepExecution's convert method wrote these files to the controller using unvalidated parameter names. The commit patches both aspects by excluding FileParameterDefinition from descriptors and adding validation checks in the execution path. The pre-patch versions of these functions directly enabled the insecure file write mechanism.