-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from form validation methods that: 1) Lacked @POST annotations (allowing CSRF via GET), and 2) Didn't verify ADMINISTER permissions. The commit explicitly adds both @POST annotations and Jenkins.get().checkPermission(Jenkins.ADMINISTER) calls to these methods. The affected methods handle credential validation and configuration - critical paths for the described credential leakage vulnerability. The direct correlation between the CVE description and the patched methods in the commit provides high confidence.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.sonatype.nexus.ci:nexus-jenkins-plugin | maven | < 3.18.1-01 | 3.18.1-01 |