Jenkins Project Jenkins
En bref
- Source
- NVD
- EPSS
- EPSS 67.15 % · centile 99 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- jenkins
- Statut NVD
- Modified
Rechercher sur…
Description
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
Faiblesses (CWE)
- CWE-346 — Erreur de validation de l'origine
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- GHSA-53ph-2r2x-vqw8 — Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
Références européennes
- ENISA EUVD · EUVD-2024-0256
- GCVE · GCVE-0-2024-23898
Configurations affectées (CPE NVD)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*≥ 2.217 ≤ 2.441cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*≥ 2.222.1 ≤ 2.426.2
Produits affectés
| Produit | Versions |
|---|---|
| Jenkins Project · Jenkins | unaffected 0 < 2.217 ; unaffected 2.442 < * ; unaffected 2.426.3 < 2.426.* ; unaffected 2.440.1 < 2.440.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |