-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions improper path validation in form validation methods. Jenkins plugins typically implement form validation through 'doCheck[FieldName]' methods in DescriptorImpl classes. The PWauth plugin's configuration would logically include a field for specifying the pwauth executable path, with a corresponding doCheckPwauthPath validation method. The lack of path normalization/sanitization in this method would allow attackers to submit paths with traversal sequences (e.g., ../../etc/passwd) to probe the filesystem. This matches the CWE-22 pattern described and the advisory's focus on form validation endpoints.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jvnet.hudson.plugins:pwauth | maven | <= 0.4 |
A Semantic Attack on Google Gemini - Read the Latest Research