PT-2024-30269 · Jenkins+1 · Jenkins+1

Daniel Beck · Published 2024-08-07 · Updated 2024-09-19 · CVE-2024-43045

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.470 and earlier Jenkins LTS versions 2.452.3 and earlier

Description The issue arises from a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views". Additionally, attackers with global View/Configure and View/Delete permissions can modify other users' "My Views".

Recommendations For Jenkins versions 2.470 and earlier, update to version 2.471 or later to restrict access to a user’s "My Views" to the owning user and administrators. For Jenkins LTS versions 2.452.3 and earlier, update to version 2.452.4 or later, or version 2.462.1 or later, to restrict access to a user’s "My Views" to the owning user and administrators.

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

BIT-JENKINS-2024-43045

CVE-2024-43045

GHSA-8PV9-QH96-9HC6

Affected Products

Jenkins

Red Os

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2024-43045 · Security Note
• https://osv.dev/vulnerability/GHSA-8pv9-qh96-9hc6 · Vendor Advisory
• https://jenkins.io/security/advisory/2024-08-07/#SECURITY-3349 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2024-43045 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43045 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/efece77d759b38c95b39b191051a8203bbc2f428 · Note
• https://github.com/jenkinsci/jenkins/commit/0c13259cebc6a780fee7825838f4dd98ece8e68a · Note
• https://github.com/jenkinsci/jenkins/commit/3752f406bfef764e4954238acf44343169ae5799 · Note
• https://t.me/securixy_kz/959 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-jenkins-cve-2024-43045-cve-2024-43044 · Note
• https://t.me/cvedetector/2688 · Telegram Post
• https://twitter.com/Brandefense/status/1822921027933909350 · Twitter Post
• https://t.me/cvenotify/90972 · Telegram Post