CVE-2024-52549

State: Published
Severity: 4.3 Medium
Published: Nov 13, 2024
Updated: Nov 13, 2024
Reserved: Nov 12, 2024

Description

Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
Jenkins Script Security PluginJenkins Project	1362.v67dc1f0e1b_b_3 and earlierAffected 1365.v4778ca_84b_de5Affected 1366.vd44b_49a_5c85c through 1367.vdf2fc45f229cAffected

References

Jenkins Security Advisory 2024-11-13vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.