-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:cisco-spark-notifier-plugin | maven | <= 1.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks in HTTP endpoints handling credential enumeration. Jenkins plugins typically implement credential dropdown population and validation via methods in the DescriptorImpl class (e.g., doFillItems and doCheck). These methods are common vectors for CWE-862 when lacking @RequirePermission annotations or explicit Jenkins.get().checkPermission() calls. The pattern matches similar credential ID enumeration vulnerabilities in other Jenkins plugins (e.g., Orka, GitHub Pull Request Builder), where form validation/auto-complete endpoints were improperly secured.