CVE-2024-43045
Fixed in a distro release EPSS 3%CVSS 6.3
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".
Products: Jenkins project Jenkins
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.452.4 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.462.1 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.471 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | jenkins | 2.471-r0 |
| Chainguard | jenkins-2.462 | 2.462.3-r8 |
| Chainguard | jenkins-compat | 2.471-r0 |
| Chainguard | jenkins-remoting | 2.471-r0 |
| Wolfi | jenkins | 2.471-r0 |
| Wolfi | jenkins-compat | 2.471-r0 |
| Wolfi | jenkins-remoting | 2.471-r0 |