-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:validating-email-parameter | maven | <= 1.10 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability explicitly stems from unescaped parameter names/descriptions in the plugin's UI rendering. Jenkins plugins typically handle parameter metadata via ParameterDefinition subclasses and Jelly views. The advisory confirms the plugin disables core security hardening (SECURITY-353/CVE-2017-2601), which enforced escaping in parameter displays. This implies the plugin's implementation overrides default secure rendering mechanisms, likely in its Jelly templates (e.g., using ${parameter.name} without escape attributes) or Java code returning raw strings. While exact code isn't provided, the pattern matches known Jenkins XSS vulnerabilities where parameter metadata is rendered without contextual output encoding.
Ongoing coverage of React2Shell