-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe advisory explicitly states the vulnerability stems from a missing permission check in a form validation method. Jenkins plugins typically implement form validation methods in DescriptorImpl classes with 'doValidate' prefixes. The ThreadFixBuilder's descriptor would logically contain validation logic for application URLs. The combination of missing permission checks (Jenkins.get().checkPermission) and lack of @RequirePOST annotation matches the described vulnerability pattern (CWE-862). The high confidence comes from the direct match between the advisory description and common Jenkins plugin implementation patterns.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:threadfix | maven | <= 1.5.4 |
JavaJavaOngoing coverage of React2Shell