-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.compuware.jenkins:compuware-scm-downloader | maven | < 2.0.13 | 2.0.13 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from RemoteSystemProperties implementing hudson.remoting.Callable without role restrictions in pre-patch versions. The call() method returns System.getProperties(), which would leak sensitive information when executed on the controller. The fix changed the base class to MasterToSlaveCallable, which enforces controller-to-agent execution direction. The empty checkRoles() method in the original implementation (removed in the patch) failed to enforce security boundaries, making the call() method exploitable when invoked from agents.
A Semantic Attack on Google Gemini - Read the Latest Research