-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 2.50, < 2.414.2 | 2.414.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.415, < 2.424 | 2.424 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure temporary file handling in plugin installation. The commit diff shows the patched version adds a secure subdirectory (tmpDir) parameter to File.createTempFile(), while the original vulnerable code used the system temp directory. The doUploadPlugin method is directly responsible for this file creation operation. The security advisory specifically mentions this code path as the source of insecure file permissions when deploying plugins from URLs, and the test cases added in PluginManagerSecurity3072Test.java validate the permission changes.