CVE-2024-23900

State: Published
Severity: 4.3 Medium
Published: Jan 24, 2024
Updated: Jun 16, 2025
Reserved: Jan 23, 2024

Description

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Jenkins Matrix Project PluginJenkins Project	822.v01b_8c85d16d2 and earlierAffected

References

Jenkins Security Advisory 2024-01-24vendor-advisory
http://www.openwall.com/lists/oss-security/2024/01/24/6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.