-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from using an unrestricted Callable implementation that didn't enforce execution location. The commit diff shows the class was changed from implementing hudson.remoting.Callable to extending jenkins.security.MasterToSlaveCallable, which explicitly restricts execution to agents. The original implementation's checkRoles method was empty (a common pattern in insecure Callables), allowing the message to execute on the controller. The call() method's access to System.getProperties() becomes dangerous when executed on the controller node, which is exactly what the vulnerability describes.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.compuware.jenkins:compuware-topaz-utilities | maven | < 1.0.9 | 1.0.9 |
Ongoing coverage of React2Shell