-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:simple-queue | maven | < 1.4.7 | 1.4.7 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing POST method enforcement on state-changing endpoints. The patch adds @RequirePOST annotations to both doMove and doReset methods, indicating these were the vulnerable endpoints that accepted unsafe HTTP methods. These handler methods directly process the queue manipulation requests that were exploitable via CSRF. The Jelly template changes converting <a> tags to POST links support this by showing the UI triggers for these endpoints.
JavaJavaOngoing coverage of React2Shell