-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from HTTP endpoints in the plugin that handle credential verification and connection testing. Jenkins plugins typically implement such endpoints via Stapler actions in DescriptorImpl classes. The advisory explicitly states these endpoints lack permission checks (CWE-862) and CSRF protections (allowing GET requests). While exact method names aren't provided in public disclosures, methods like doVerifyCredentials and doTestConnection are common patterns for credential-related endpoints in Jenkins plugins. The confidence is 'medium' because the assessment relies on Jenkins plugin architecture conventions rather than direct code evidence.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:ease-plugin | maven | <= 2.6 |
JavaJavaOngoing coverage of React2Shell