CVE-2024-23898

Katalog CVE

CVSS 8.8 · High EPSS 67,2%

Kerentanan Origin Validation Error pada jenkins. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Rincian

Terbit di NVD

24 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

67,2% peluang dieksploitasi; lebih tinggi dari 99,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315 advisory vendor
• http://www.openwall.com/lists/oss-security/2024/01/24/6
• https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/