VDB
BDU%3A2024-00751
BDU%3A2024-00751
PUBLISHED
CVSS 10 CRITICAL
Уязвимость встроенного интерфейса командной строки (CLI) сервера автоматизации Jenkins, позволяющая нарушителю реализовать CSWSH-атаку
Risk Scores
CVSS 2.0
10
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ООО «Ред Софт», CD Foundation | РЕД ОС (запись в едином реестре российских программ №3751), Jenkins | |
| Jenkins Project | Jenkins | 0, 2.442, 2.426.3 |
Timeline
- Jan 24, 2024 CVE Published
- Jan 24, 2024 PoC Published
- Jan 26, 2024 PoC Published
- Jan 28, 2024 PoC Published
- Jan 29, 2024 PoC Published
- Feb 18, 2024 PoC Published
- Feb 20, 2024 PoC Published
- Apr 15, 2024 CVE Updated
- Jun 20, 2025 PoC Published
References
- https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315 url
- https://vuldb.com/ru/?id.251998 url
- http://repo.red-soft.ru/redos/7.3c/x86_64/updates/ url
- https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/ url
- http://www.openwall.com/lists/oss-security/2024/01/24/6 url