CVE-2024-23905

2024-01-2417:52:27

jenkins

www.cve.org

cve-2024-23905

jenkins

red hat

dependency analytics plugin

content security policy

user-generated content

workspaces

archived artifacts

download

AI Score

6.1

Confidence

High

EPSS

Percentile

13.3%

JSON

Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

CNA Affected

[
  {
    "vendor": "Jenkins Project",
    "product": "Jenkins Red Hat Dependency Analytics Plugin",
    "versions": [
      {
        "version": "0",
        "versionType": "maven",
        "lessThanOrEqual": "0.7.1",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]