-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key points: 1) The InputStep.setId method allowed arbitrary characters in the 'id' parameter without validation, enabling malicious IDs. 2) The Jelly template used these raw IDs in form action URLs without encoding. The commit added ID validation (doCheckId) in InputStep.java and encoding in index.jelly, confirming these were the vulnerable points. The test cases explicitly validate() these fixes, reinforcing their role in the vulnerability.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:pipeline-input-step | maven | < 456.vd8a | 456.vd8a_957db_5b_e9 |
Ongoing coverage of React2Shell