-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped parameter names/descriptions in views. Jenkins plugins typically use Jelly views (*.jelly files) to render parameters. The advisory explicitly states the plugin fails to escape these fields when displaying parameters. While exact implementation details aren't provided, the pattern matches Jenkins' ParameterDefinition rendering conventions where name/description fields would be output in Jelly views using ${} without escaping (rather than ${% raw %}{%}{% endraw %} or explicit escape calls). These rendering functions would be located in the parameter definition views for the affected parameter types.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:readonly-parameters | maven | <= 1.0.0 |
Ongoing coverage of React2Shell