-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the /githook endpoint lacking authentication. In Jenkins plugin architecture, HTTP endpoints are typically handled by methods in controller classes annotated with @WebMethod or extending Stapler's HttpResponses. The advisory explicitly states this endpoint is unprotected, implying the handler method (commonly doIndex() in Stapler-based controllers) does not call Jenkins.get().checkPermission() or similar authorization checks. The class name GitHookController and method doIndex() are inferred from standard Jenkins plugin patterns and the endpoint's functionality.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.groupon.jenkins-ci.plugins:DotCi | maven | <= 2.40.00 |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report