-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues in PomParser.java: 1) Use of FileCallable instead of MasterToSlaveFileCallable allowed agent-initiated execution on the controller, and 2) The XML parser wasn't configured to prevent XXE. The commit diff shows replacement of FileCallable with MasterToSlaveFileCallable and removal of vulnerable exception handling patterns. The invoke() method's XML parsing without XXE protections (no disabling of external entities) combined with the agent execution path created the vulnerability. The file path handling in getPom() method also lacked restrictions, enabling path traversal attacks.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:semantic-versioning-plugin | maven | < 1.15 | 1.15 |
Ongoing coverage of React2Shell