-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing Jenkins.ADMINISTER permission checks in 'doTestConnection' methods across multiple credential implementations. These methods handle HTTP endpoints for Vault connection testing. The commit 3b38d76 explicitly adds Jenkins.get().checkPermission(Jenkins.ADMINISTER) to all these methods, confirming they were the attack surface. The CWE-862 (Missing Authorization) maps directly to the absence of these checks, allowing attackers with lower privileges to exploit the endpoints. The Jelly UI changes further support this by hiding test buttons from non-admins, but the core vulnerability was in the backend authorization logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.datapipe.jenkins.plugins:hashicorp-vault-plugin | maven | <= 354.vdb | 355.v3b_38d767a_b_a_8 |
Ongoing coverage of React2Shell