Lucene search

CVE-2024-23898

🗓️ 24 Jan 2024 18:09:15Reported by jenkinsType

cve🔗 web.nvd.nist.gov📰️ 20 Media mentions👁 181 Views🌐 WEB

Jenkins CVE-2024-23898 CSWSH vulnerabilit

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 27
Veracode	Cross-Site WebSocket Hijacking (CSWSH)	31 Jan 202407:28	–	veracode
OSV	CVE-2024-23898	24 Jan 202418:15	–	osv
OSV	GHSA-53PH-2R2X-VQW8 Cross-site WebSocket hijacking vulnerability in the Jenkins CLI	24 Jan 202418:31	–	osv
OSV	BIT-JENKINS-2024-23898	6 Mar 202410:53	–	osv
OSV	CGA-4H3F-M3QP-F3FR	6 Jun 202412:23	–	osv
OSV	RHSA-2024:0776 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update	30 Sep 202407:10	–	osv
OSV	RHSA-2024:0775 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update	30 Sep 202416:32	–	osv
OSV	RHSA-2024:0778 Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update	30 Sep 202415:05	–	osv
Prion	Cross site scripting	24 Jan 202418:15	–	prion
RedhatCVE	CVE-2024-23898	25 Jan 202420:22	–	redhatcve

Nvd

Node

jenkins jenkinsRange2.217–2.441-

jenkins jenkinsRange2.222.1–2.426.2lts

[
  {
    "defaultStatus": "affected",
    "product": "Jenkins",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThan": "2.217",
        "status": "unaffected",
        "version": "0",
        "versionType": "maven"
      },
      {
        "lessThan": "*",
        "status": "unaffected",
        "version": "2.442",
        "versionType": "maven"
      },
      {
        "lessThan": "2.426.*",
        "status": "unaffected",
        "version": "2.426.3",
        "versionType": "maven"
      },
      {
        "lessThan": "2.440.*",
        "status": "unaffected",
        "version": "2.440.1",
        "versionType": "maven"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/01/24/6
sonarsource	www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
jenkins	www.jenkins.io/security/advisory/2024-01-24/

Parameter	Position	Path	Description	CWE
payload	request body	/script	Allows execution of arbitrary Groovy script, potentially leading to remote code execution in Jenkins.	CWE-346
auth_token	request body	/ws	Cross-site WebSocket hijacking potential, enabling unauthorized CLI command execution on Jenkins.	CWE-346

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

24 Jan 2024 18:15Current

8.5High risk

Vulners AI Score8.5

CVSS38.8

EPSS0.38965

CWE-346