-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from an unauthenticated HTTP endpoint allowing credential ID enumeration. Jenkins plugins typically expose endpoints via Stapler or JAX-RS routes, and credential enumeration would involve accessing CredentialsProvider API. The absence of a permission check (e.g., Jenkins.get().checkPermission(CredentialsProvider.VIEW)) in the endpoint handler matches the CWE-862 description. The function name/path is inferred from standard Jenkins plugin patterns and the plugin's purpose (Apprenda integration).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:apprenda | maven | <= 2.2.0 |
JavaJavaOngoing coverage of React2Shell