CVE-2024-23898

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI…

High · published January 24, 2024

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 99.3th percentile for exploit probability.

CVSS v3.1
8.8
EPSS
67%
Percentile
99.3
In the wild
Unconfirmed
What it is

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.67151 · 99.3th percentile
Published
2024-01-24T17:52Z
EPSS history
Timeline
  • 24 JAN 17:52Z
    Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI…
    cvelistv5