-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.sonatype.nexus.ci:nexus-jenkins-plugin | maven | < 3.18.1-01 | 3.18.1-01 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from form validation methods that: 1) Did not require POST requests (CSRF vector), 2) Lacked Jenkins.ADMINISTER permission checks (allowing Overall/Read users to trigger actions), and 3) Processed external XML responses without XXE protection. The commit diff explicitly shows these methods were modified by adding @POST annotations and permission checks, confirming their pre-patch vulnerable state. The affected methods handle HTTP endpoints for configuration validation and credential verification, which when unprotected, allowed attackers to trigger malicious XML parsing and credential leaks via CSRF.
Ongoing coverage of React2Shell