-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:jianliao | maven | <= 1.1 |
Miggo AIRoot Cause AnalysisThe advisory explicitly mentions a missing permission check in a form validation method. Jenkins plugins typically implement form validation in DescriptorImpl classes using do* methods (e.g., doTestConnection). The combination of: 1) No permission check (violating SECURITY-2240's CWE-862) 2) Lack of POST method enforcement (enabling CSRF) matches the pattern of connection test methods that interact with external URLs. While exact code isn't public, this is the standard implementation pattern for Jenkins plugin form validation endpoints.
Ongoing coverage of React2Shell