Jenkins Project Jenkins
En bref
- Source
- NVD
- EPSS
- EPSS 0.67 % · centile 52 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- jenkins
- Statut NVD
- Modified
Description
If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.
Faiblesses (CWE)
- CWE-843 — Confusion de type (accès à une ressource via un type incompatible)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- GHSA-f9qj-77q2-h5c5 — Jenkins item creation restriction bypass vulnerability
Références européennes
- ENISA EUVD · EUVD-2024-3030
- GCVE · GCVE-0-2024-47804
Configurations affectées (CPE NVD)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*< 2.462.3cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*< 2.479
Produits affectés
| Produit | Versions |
|---|---|
| Jenkins Project · Jenkins | unaffected 2.462.3 < 2.462.* ; unaffected 2.479 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |