-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from folder-scoped library overrides being declared as trusted in vulnerable versions. The key function would be the one responsible for setting the 'trusted' flag for these overrides. Jenkins plugin architecture typically uses methods like isTrusted() in library configuration classes to control sandbox execution. The patch explicitly changes this trust designation, indicating this was the vulnerable point. While exact code isn't available, the pattern matches Jenkins' security model and the advisory's technical description.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:shared-library-version-override | maven | < 19.v3a | 19.v3a |
Ongoing coverage of React2Shell