-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unconstrained processing of multipart requests via Apache Commons FileUpload. The MultipartFormDataParser constructor was vulnerable as it didn't enforce part count limits until the patch added FILEUPLOAD_MAX_FILES. Similarly, StaplerRequest#getFile uses the same vulnerable library without initial limits. The commit b70f4cb shows explicit limits being added to MultipartFormDataParser usage, confirming these were the entry points for uncontrolled resource consumption.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | < 2.375.4 | 2.375.4 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.388, < 2.394 | 2.394 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.376, < 2.387.1 | 2.387.1 |