-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure temporary file creation in the CLI file parameter handling. The commit diff shows a direct replacement of File.createTempFile() with Files.createTempFile() in FileParameterDefinition.java, which enforces more restrictive file permissions. The createValue method is the entry point for processing file parameters via CLI, making it the logical location for the vulnerable temp file creation. The CVE description explicitly mentions the temp file permission issue, and the commit directly addresses it by changing the temp file creation method.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | < 2.375.4 | 2.375.4 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.376, < 2.387.1 | 2.387.1 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.388, < 2.394 | 2.394 |
Ongoing coverage of React2Shell