-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin | maven | <= 2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped parameter names/descriptions in UI views. Jenkins plugins typically implement parameter rendering via Jelly templates. The advisory specifically calls out XSS in parameter display pages, which maps to view templates for parameter definitions. While exact code isn't available, the pattern matches known Jenkins XSS vulnerabilities where parameter metadata isn't escaped in Jelly files. The high confidence comes from the direct match between described vulnerability mechanics and Jenkins' standard parameter rendering implementation patterns.
Ongoing coverage of React2Shell