-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:screenrecorder | maven | <= 0.7 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from the plugin's modification of the Java system property controlling Content-Security-Policy headers. Jenkins' DirectoryBrowserSupport relies on this property to set CSP headers for static content. By setting it to 'media-src: self' without maintaining other default directives (like script-src), the plugin effectively nullifies XSS protections. The act of modifying this system property via System.setProperty() is the root cause, as confirmed by the advisory's description of how the CSP header gets overwritten.
Ongoing coverage of React2Shell