-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from an HTTP endpoint allowing state-changing operations (tag deletion) without requiring POST requests. In Jenkins plugin architecture, such endpoints are typically implemented as do* methods in Action classes. The lack of @RequirePOST annotation (common Jenkins CSRF protection) would make this function vulnerable. The naming convention 'doDeleteTag' follows Jenkins pattern for form actions, and the BazaarTagAction class is the logical location for tag management functionality.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:bazaar | maven | <= 1.22 |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report