-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability describes an HTTP endpoint with missing authorization that allows deletion of statistics. In Jenkins plugin architecture, such operations are typically handled by do[Action] methods in Java classes. The combination of missing permission checks (no Jenkins.get().checkPermission() call) and lack of POST request requirement aligns with a standard doDelete() handler. The confidence is high because this matches both the CWE-862 description and Jenkins' typical endpoint implementation patterns, even without seeing the actual code.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.zeroturnaround:cluster-stats | maven | <= 0.4.6 |
JavaJavaOngoing coverage of React2Shell