CVE-2024-23900

2024-01-2418:15:09

Google

osv.dev

jenkins

matrix project plugin

vulnerability

config.xml

attackers

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.1%

JSON

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

CPENameOperatorVersion
matrix-project-plugineqmatrix-project-1.17
matrix-project-plugineqmatrix-project-1.13
matrix-project-plugineqmatrix-project-1.1
matrix-project-plugineq822.v01b_8c85d16d2
matrix-project-plugineqmatrix-project-1.0
matrix-project-plugineqmatrix-project-1.20
matrix-project-plugineqmatrix-project-1.0-beta-1
matrix-project-plugineq772.v494f19991984
matrix-project-plugineqmatrix-project-1.14
matrix-project-plugineqmatrix-project-1.9

Name	Operator	Version
matrix-project-plugin	eq	matrix-project-1.17
matrix-project-plugin	eq	matrix-project-1.13
matrix-project-plugin	eq	matrix-project-1.1
matrix-project-plugin	eq	822.v01b_8c85d16d2
matrix-project-plugin	eq	matrix-project-1.0
matrix-project-plugin	eq	matrix-project-1.20
matrix-project-plugin	eq	matrix-project-1.0-beta-1
matrix-project-plugin	eq	772.v494f19991984
matrix-project-plugin	eq	matrix-project-1.14
matrix-project-plugin	eq	matrix-project-1.9