GHSA-8pv9-qh96-9hc6MediumCVSS 5.4

Jenkins does not perform a permission check in an HTTP endpoint

Published
August 7, 2024
Last Modified
August 16, 2024

🔗 CVE IDs covered (1)

CVE-2024-43045 →

📋 Description

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to access other users' "My Views". Attackers with global View/Configure and View/Delete permissions are also able to change other users' "My Views".

Jenkins 2.471, LTS 2.452.4, LTS 2.462.1 restricts access to a user’s "My Views" to the owning user and administrators.

🎯 Affected products3

  • maven/org.jenkins-ci.main:jenkins-core:< 2.452.4
  • maven/org.jenkins-ci.main:jenkins-core:>= 2.460, < 2.462.1
  • maven/org.jenkins-ci.main:jenkins-core:>= 2.470, < 2.471

🔗 References (6)