BIT-jenkins-2024-23898

Import Source
https://github.com/bitnami/vulndb/tree/main/data/jenkins/BIT-jenkins-2024-23898.json
Aliases
Published
2024-02-01T07:19:10.357Z
Modified
2024-03-01T07:47:32.561Z
Details

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

References

Affected packages

Bitnami / jenkins

Package

Name
jenkins

Affected ranges

Type
SEMVER
Events
Introduced
2.222.1
Fixed
2.426.2