GitHub Advisoryadvisory · Maven

GHSA-8pv9-qh96-9hc6 Jenkins does not perform a permission check in an HTTP endpoint

MEDIUM Published 2024-08-07 Modified 2025-03-25 Official page ↗
Aliases
CVE-2024-43045
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-285, CWE-862
Reviewed
2024-08-07

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.452.4 → fixed in 2.452.4 • Maven org.jenkins-ci.main:jenkins-core: >= 2.460, < 2.462.1 → fixed in 2.462.1 • Maven org.jenkins-ci.main:jenkins-core: >= 2.470, < 2.471 → fixed in 2.471

Description

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to access other users' "My Views". Attackers with global View/Configure and View/Delete permissions are also able to change other users' "My Views". Jenkins 2.471, LTS 2.452.4, LTS 2.462.1 restricts access to a user’s "My Views" to the owning user and administrators.

Related

Alias · CVE (1)

  • CVE-2024-43045 Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with… vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-862 Missing Authorization weakness

References