-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.paul8620.jenkins.plugins:pipeline-aggregator-view | maven | < 1.14 | 1.14 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped URL injection in JavaScript context. Jenkins plugins typically use Jelly templates for views, and the advisory specifically mentions inline JavaScript handling of view URLs. The main view template (index.jelly) would be the logical location for this URL reference. The high confidence comes from: 1) The vulnerability description explicitly calls out inline JavaScript URL handling 2) Jenkins' known use of Jelly templating 3) The fix involving changing URL retrieval methodology rather than just output encoding suggests the vulnerable code was directly embedding ${view.url} or similar in script tags without JS_ESCAPE.
Ongoing coverage of React2Shell