-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability arises from unescaped plot descriptions in the Jenkins Plot Plugin. The commit diff shows the fix involved changing the output method from <j:out> to a <span> with ${...} interpolation. In Jenkins Jelly templates, ${...}typically auto-escapes content when used in HTML contexts, while<j:out>also should escape. However, the vulnerability's existence implies the original<j:out>usage failed to properly escape the output, possibly due to the method returning pre-escaped or unsafe HTML. The functiongetPlotDescription()` is directly responsible for providing the unescaped content, making it the vulnerable component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:plot | maven | < 2.1.11 | 2.1.11 |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report