-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:dimensionsscm | maven | <= 0.9.3 | 0.9.3.1 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from a missing permission check in an HTTP endpoint. Jenkins plugins typically implement such endpoints via Stapler methods in descriptor classes. The advisory explicitly states the flaw allowed credential ID enumeration via an unsecured endpoint, which aligns with form validation or API methods (e.g., doCheckCredentialsId). The descriptor class DimensionsSCM$DescriptorImpl is the logical location for credential management, and the method name follows Jenkins conventions for form validation (doCheck*). While the exact code changes are unavailable, the advisory's description of the fix (adding permission checks) strongly suggests this method was the vulnerable point.
Ongoing coverage of React2Shell