-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.groupon.jenkins-ci.plugins:DotCi | maven | <= 2.40.00 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped GitHub user names in build cause displays. Jenkins plugins typically use the getShortDescription() method in Cause subclasses to generate UI messages. Since the advisory explicitly states the user name isn't escaped during display, this method is the logical point where raw user input is incorporated into HTML without sanitization. The stored XSS occurs when this unescaped value is rendered in the UI. While the exact code isn't visible, this pattern matches Jenkins plugin architecture and the described vulnerability mechanism.
Ongoing coverage of React2Shell