-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsafe YAML deserialization - a classic CWE-502 pattern. While exact function names/paths aren't available in advisories, the root cause is clearly the YAML parser configuration. In Java/YAML ecosystems (using libraries like SnakeYAML), RCE occurs when Yaml.load() is used without restricting types. The advisory explicitly states the parser wasn't configured to prevent arbitrary type instantiation, which matches this pattern. The high confidence comes from: 1) Direct match with described vulnerability type 2) Consistency with YAML deserialization best practices 3) Explicit mention of 'arbitrary types' in the CWE-502 context.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.groupon.jenkins-ci.plugins:DotCi | maven | <= 2.40.00 |