-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer | maven | < 2.4.2 | 2.4.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two flaws in the connection test endpoint: 1) Missing Jenkins.ADMINISTER permission check (CWE-862), and 2) Lack of POST method enforcement (enabling CSRF). The commit a261229 shows the fix added both the permission check and @POST annotation to doTestConnection. The testConnection handler in MongoDBKnowledgeBase.java was the affected endpoint, as confirmed by security tests in CauseManagementPermissionTest.java that validate() POST enforcement and admin requirements post-fix.
Ongoing coverage of React2Shell