CVE-2024-52550

Description

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.

CVSS Metrics

• v4.0•HIGH•Score: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
• v3.1•HIGH•Score: 8CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 1.40%• Percentile: 81%

Techniques & Countermeasures

• CWE-354•Improper Validation of Integrity Check Value

  The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Affected Systems

• jenkins project•jenkins pipeline: groovy plugin

  ≤ 3975.v567e2a_1ffa_22 | 3990.vd281dd77a_388

• org.jenkins-ci.plugins.workflow•workflow-cps

  < 3993.v3e20a

References (3)

• https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362
• https://nvd.nist.gov/vuln/detail/CVE-2024-52550
• https://github.com/jenkinsci/workflow-cps-plugin