-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from a controller/agent message handler that retrieves system properties. Jenkins plugins typically implement such messages via classes extending MasterToSlaveCallable. The absence of execution origin checks in the call() method allowed agent-triggered controller-side execution. The patched version 1.0.9 specifically blocks agent-initiated execution of this message, confirming this as the vulnerable entry point. The function name and pattern follow Jenkins plugin conventions for RPC-style controller/agent communication.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.compuware.jenkins:compuware-ispw-operations | maven | <= 1.0.8 | 1.0.9 |