-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped user-controlled inputs (log file path and project name) in form validation endpoints. Jenkins plugins typically implement form validation using 'doCheck[FieldName]' methods in their DescriptorImpl classes. The advisory explicitly identifies these two fields as vulnerable points, and the lack of output encoding in their validation handlers would directly enable XSS payload injection. The pattern matches Jenkins' form validation architecture and the described attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:sonargraph-integration | maven | <= 5.0.1 |