-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing permission checks in HTTP endpoints handling credential validation and scan initiation. Jenkins plugins typically implement these endpoints via methods prefixed with 'do' (e.g., doCheck*, doStartScan) in descriptor or action classes. The advisory explicitly states the lack of authorization checks in these endpoints, which aligns with common patterns where form validation and scan execution methods would require security annotations like @RequiresPermission. While the exact code isn't provided, the described vulnerability mechanics and Jenkins plugin conventions strongly suggest these functions as the vulnerable points.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.qualys.plugins:qualys-was | maven | < 2.0.11 | 2.0.11 |
Ongoing coverage of React2Shell