-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe core vulnerability stems from missing HTTP method validation on an item copy endpoint. Jenkins security advisories explicitly state the fix required adding POST method enforcement. In Jenkins plugin architecture, HTTP handlers like doCopyItem in folder implementations would be annotated with @RequirePOST in patched versions. The vulnerable version lacked this security control, making this method the direct entry point for CSRF exploitation. The function name follows Jenkins' standard do[Action] pattern for HTTP endpoints in AbstractFolder implementations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:cloudbees-folder | maven | < 6.848.ve3b | 6.848.ve3b |