-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:testquality-updater | maven | <= 1.3 |
JavaJavaMiggo AIRoot Cause AnalysisThe advisory explicitly mentions: 1) Missing permission check in form validation methods, 2) CSRF vulnerability due to missing POST requirement. In Jenkins plugins, form validation endpoints like connection test handlers are typically implemented as do* methods in Descriptor classes. The combination of missing @RequirePOST annotation and missing permission check in a connection testing method aligns with the described attack vector where attackers can force Jenkins to connect to attacker-controlled endpoints with specified credentials.
Ongoing coverage of React2Shell