Description

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Remediation

References

CVE-2024-23898

Related Vulnerabilities

WordPress Plugin FG PrestaShop to WooCommerce Cross-Site Scripting (3.19.1)

WordPress Plugin MC4WP:Mailchimp for WordPress Cross-Site Scripting (2.2.7)

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-5502)

WordPress Plugin Safe Editor Unspecified Vulnerability (1.1)

WordPress Plugin WP ERP-Complete WordPress Business Manager with HR, CRM & Accounting Systems for Small Businesses Cross-Site Request Forgery (1.6.3)

Severity

High

Classification

CVE-2024-23898 CWE-346 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities