-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.sonatype.nexus.ci:nexus-jenkins-plugin | maven | < 3.18.1-01 | 3.18.1-01 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from form validation methods that lacked both permission checks (requiring only Overall/Read instead of ADMINISTER) and CSRF protections (allowing GET requests). The GitHub commit explicitly adds @POST annotations and Jenkins.ADMINISTER checks to these specific methods across multiple configuration classes, confirming they were the vulnerable endpoints. The direct correlation between the patch and these functions' security improvements provides high confidence in identification.
KEV Misses 88% of Exploited CVEs- Get the report