-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions an HTTP endpoint that 1) lacks permission checks, 2) accepts non-POST requests (CSRF vulnerability), and 3) reconfigures plugin settings. In Jenkins plugin architecture, connection test endpoints are typically implemented as do[Action] methods in Descriptor classes. The combination of missing permission checks (CVE-2024-2216) and lack of POST requirement (CVE-2024-2215) strongly suggests this test connection handler is the vulnerable function. The DockerBuilderDescriptor class is the logical location for Docker connection configuration in this plugin.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:docker-build-step | maven | <= 2.11 |
Ongoing coverage of React2Shell