-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:role-strategy | maven | < 587.588.v850a | 587.588.v850a_20a_30162 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from how implying permissions were cached and validated. In the pre-patch code, cacheImplyingPermissions() iterated through permissions without checking if they were enabled, populating a static cache. getImplyingPermissions() then served these cached permissions, including disabled ones. The fix introduced a time-bound cache and added explicit enabled checks in cacheImplyingPermissions(), confirming these functions as the root cause. The test case added in the commit also directly targets this logic, reinforcing the analysis.
Ongoing coverage of React2Shell