PT-2024-35370 · Jenkins · Jenkins Script Security Plugin+1

Published 2024-11-13 · Updated 2025-10-10 · CVE-2024-52549

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1367.vdf2fc45f229c and earlier, except 1365.1367.va 3b b 89f8a 95b and 1362.1364.v4cf2dc5d8776

Description The issue concerns a method implementing form validation that does not perform a permission check, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system. This could potentially be exploited by attackers to gather information about the system.

Recommendations For Jenkins Script Security Plugin versions 1367.vdf2fc45f229c and earlier, except 1365.1367.va 3b b 89f8a 95b and 1362.1364.v4cf2dc5d8776, update to version 1368.vb b 402e3547e7 or later, which requires Overall/Administer permission for the affected form validation method. At the moment, there is no other information about additional mitigation measures for this vulnerability.

Fix

Missing Authorization

Missing Authentication

Weakness Enumeration

CWE-862

CWE-306

Related Identifiers

CVE-2024-52549

GHSA-JV82-75FH-23R7

RHSA-2025:2218

RHSA-2025:2219

RHSA-2025:2220

RHSA-2025:2221

RHSA-2025:2222

RHSA-2025:2223

Affected Products

Jenkins

Jenkins Script Security Plugin

References · 9

• https://jenkins.io/security/advisory/2024-11-13/#SECURITY-3447 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jv82-75fh-23r7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52549 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52549 · Vendor Advisory
• https://github.com/jenkinsci/script-security-plugin · Note
• https://twitter.com/VulmonFeeds/status/1856826107913294127 · Twitter Post
• https://t.me/cvedetector/10876 · Telegram Post
• https://t.me/cveNotify/138160 · Telegram Post
• https://twitter.com/CVEnew/status/1856828016317665692 · Twitter Post