CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2024-43044
High (8.8) in jenkins jenkins. EPSS 29% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:remoting 3206.3208, 3248.3250, 3256.3258.
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
Severity
- EPSS
- 29% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-754
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:jenkins
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h856-ffvv-xvr4 | Maven | org.jenkins-ci.main:remoting | <3206.3208 | 3206.3208 |
| GHSA-h856-ffvv-xvr4 | Maven | org.jenkins-ci.main:remoting | >=3248 <3248.3250 | 3248.3250 |
| GHSA-h856-ffvv-xvr4 | Maven | org.jenkins-ci.main:remoting | >=3256 <3256.3258 | 3256.3258 |
| GHSA-h856-ffvv-xvr4 | Maven | org.jenkins-ci.main:jenkins-core | <2.452.4 | 2.452.4 |
| GHSA-h856-ffvv-xvr4 | Maven | org.jenkins-ci.main:jenkins-core | >=2.460 <2.462.1 | 2.462.1 |
| GHSA-h856-ffvv-xvr4 | Maven | org.jenkins-ci.main:jenkins-core | >=2.470 <2.471 | 2.471 |