Vulnerability · Published Nov 13, 2024 · Assigned by jenkins

CVE-2024-52550

High 8.0

In plain English

A high-severity security flaw in Jenkins Pipeline: Groovy Plugin from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.5%top 60.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.jenkins-ci.plugins.workflow:workflow-cps	3993.v3e20a	GHSA-mrpr-vr82-x88r

Affected products (as reported)

Vendor	Product	Versions
Jenkins Project	Jenkins Pipeline: Groovy Plugin	0 – through 3975.v567e2a_1ffa_223990.vd281dd77a_388

Weakness: CWE-354 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

Jenkins Security Advisory 2024-11-13 vendor-advisory