cve.bz

CVE-2024-23898

8.8 highEPSS 67%

High (8.8) in jenkins jenkins. EPSS 67% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.426.3, 2.442.

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
67% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-346
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-53ph-2r2x-vqw8Mavenorg.jenkins-ci.main:jenkins-core>=2.217 <2.426.32.426.3
GHSA-53ph-2r2x-vqw8Mavenorg.jenkins-ci.main:jenkins-core>=2.427 <2.4422.442
GHSA-53ph-2r2x-vqw8Mavenorg.jenkins-ci.main:jenkins-core2.441no fix published

References

Check your stackJSON