-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:matrix-project | maven | < 822.824.v14451b | 822.824.v14451b |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper path sanitization in axis name handling during config.xml submission. The commit adds a new doConfigDotXml method with XML validation and checkAxes() calls, indicating the previous implementation lacked these safeguards. The test case AxisTest.testHaxorNameFromConfigXml demonstrates the exploit by attempting to inject path traversal sequences into axis names, which would have been allowed before the sanitization was added in checkAxes(). The vulnerable function is the pre-patch implementation of config.xml handling in MatrixProject.java, specifically the absence of axis name validation during XML submission.