Patchfirst
Patchfirst
CVE-2024-23898 Public exploit High · 8.8 EPSS 67.2%

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin…

Jenkins Project · Jenkins

Summary

The Jenkins CLI WebSocket endpoint in Jenkins 2.217 through 2.441 and LTS 2.222.1 through 2.426.2 does not validate the origin of incoming requests, creating a cross-site WebSocket hijacking flaw. An attacker can use it to execute CLI commands on the Jenkins controller by luring a logged-in user to a malicious web page, with no prior authentication required but user interaction needed.

Official description · CVE.org

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Breakdown
31.7 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 10 months after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+10 mo

7 fixes in jenkins-core over 12 months. The latest fix listed for jenkins-core is 2.479.

Fixes in jenkins-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.424CVE-2023-4349720 Sep 2023
  2. 2.424CVE-2023-4349820 Sep 2023
  3. 2.442CVE-2024-2389724 Jan 2024KEV
  4. 2.442CVE-2024-2389824 Jan 2024
  5. 2.471CVE-2024-430447 Aug 2024
  6. 2.471CVE-2024-430457 Aug 2024
  7. 2.479CVE-2024-478032 Oct 2024Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.main:jenkins-core.

Mavenorg.jenkins-ci.main:jenkins-coreGHSA-53ph-2r2x-vqw8

Upgrade to 2.555.3 or later

Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2024-23897, CVE-2025-59474, +1).

Set the version to 2.555.3 or later in your pom.xml or build.gradle.

First fixed in 2.442 for CVE-2024-23898.

Affected versions, by release line

If you runUpgrade to
2.427 up to 2.4422.555.3first fix for this CVE: 2.442
2.217 up to 2.426.3

Still affected on this line by CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).

2.426.3

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 1 community threat pulse (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag

vendor-advisory 1

jenkins.io/security/advisory/2024-01-24/#SECURITY-3315

Other 2

sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/openwall.com/lists/oss-security/2024/01/24/6
↑ ↓ chooseEnter openEsc close