-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:synopsys-coverity | maven | <= 3.0.2 | 3.0.3 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing permission checks in form validation endpoints that handled credential operations. The patches consistently add 1) @POST annotations to prevent CSRF and 2) credentialsHelper.checkPermissionToAccessCredentials() calls. The vulnerable functions are the original implementations of these form-handling methods in Jenkins descriptor classes that lacked these security controls. These methods would be invoked during attacker-triggered credential enumeration/abuse scenarios, appearing in runtime profiles when malicious requests are processed.
Ongoing coverage of React2Shell