-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:email-ext | maven | < 2.96.1 | 2.96.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from an unauthenticated HTTP endpoint accepting GET requests for job watch management. In Jenkins plugin architecture, such endpoints are typically handled by do[ActionName] methods in Action classes. The advisory explicitly states the lack of POST validation was the root cause, and the patched version added this requirement. While the exact code isn't shown, the standard pattern for CSRF fixes in Jenkins involves adding requirePost() in the do* handler method - making EmailExtStopWatchingAction.doStopWatching the logical vulnerable function.