-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:jira | maven | < 3.12 | 3.12 |
KEV Misses 88% of Exploited CVEs- Get the report
Miggo AIRoot Cause AnalysisThe vulnerability centers on improper context scoping in credentials lookup. Jenkins credentials security relies on context boundaries, and system-scoped credentials require Jenkins.get() as their context. The JiraSite class likely contains the credentials retrieval logic for Jira integration. The getCredentials method would be the point where credentials are fetched, and the lack of system context in the lookupCredentials() call (using Item/Job context instead of Jenkins.get()) in pre-3.12 versions allows the exposure. The patch would explicitly set the context parameter to restrict the lookup scope.