PT-2024-35376 · Jenkins · Jenkins Shared Library Version Override Plugin+1

Daniel Beck · Published 2024-11-13 · Updated 2025-10-03 · CVE-2024-52554

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Shared Library Version Override Plugin versions 17.v786074c9fce7 and earlier

Description The issue allows attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection, as these overrides are declared as trusted and not executed in the Script Security sandbox. This could potentially be exploited by attackers to run malicious code without the protection of the sandbox.

Recommendations For versions 17.v786074c9fce7 and earlier, update to a version that declares folder-scoped library overrides as untrusted, such as version 19.v3a c975738d4a , to ensure that these overrides are executed in the Script Security sandbox. As a temporary workaround, consider restricting the Item/Configure permission on folders to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-52554

GHSA-7845-CRFJ-PHC4

Affected Products

Jenkins

Jenkins Shared Library Version Override Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-7845-crfj-phc4 · Vendor Advisory
• https://jenkins.io/security/advisory/2024-11-13/#SECURITY-3466 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52554 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52554 · Vendor Advisory
• https://t.me/cveNotify/137272 · Telegram Post
• https://github.com/jenkinsci/shared-library-version-override-plugin · Note
• https://twitter.com/CVEnew/status/1856828010802155665 · Twitter Post
• https://t.me/cvedetector/10882 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1856838908597670128 · Twitter Post