CVE-2024-52549
Fixed in a distro release EPSS <1%CVSS 4.3
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.
Products: Jenkins project Jenkins Script Security Plugin
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.plugins:script-security | 1368.vb |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat ocp tools 4.12 | jenkins | 0:2.479.3.1740464431-3.el8 |
| Red Hat ocp tools 4.12 | jenkins-2-plugins | 0:4.12.1740464689-1.el8 |
| Red Hat ocp tools 4.13 | jenkins | 0:2.479.3.1740464433-3.el8 |
| Red Hat ocp tools 4.13 | jenkins-2-plugins | 0:4.13.1740464698-1.el8 |
| Red Hat ocp tools 4.14 | jenkins | 0:2.479.3.1740109575-3.el8 |
| Red Hat ocp tools 4.14 | jenkins-2-plugins | 0:4.14.1740109868-1.el8 |
| Red Hat ocp tools 4.15 | jenkins | 0:2.479.3.1740051993-3.el8 |
| Red Hat ocp tools 4.15 | jenkins-2-plugins | 0:4.15.1740052174-1.el8 |
| Red Hat ocp tools 4.16 | jenkins | 0:2.479.3.1739896390-3.el9 |
| Red Hat ocp tools 4.16 | jenkins-2-plugins | 0:4.16.1739896683-1.el9 |
| Red Hat ocp tools 4.17 | jenkins | 0:2.479.3.1739859586-3.el9 |
| Red Hat ocp tools 4.17 | jenkins-2-plugins | 0:4.17.1739859908-1.el9 |