-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability arises from improper escaping of configuration options in the Execute NetStorm/NetCloud Test build step. The identified functions are form validation handlers (annotated with @POST) that process user-supplied parameters (e.g., URLs, usernames) and return responses. Prior to the patch, these methods did not sanitize inputs, allowing attackers to inject malicious scripts. The commit diff shows changes to parameter handling and SSL configurations, but the root cause lies in the lack of escaping when rendering these parameters in the Jenkins UI. The high confidence stems from the direct link between these functions and the user-controlled configuration options described in the advisory.
Ongoing coverage of React2Shell
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:cavisson-ns-nd-integration | maven | < 4.8.0.147 | 4.8.0.147 |