CVE-2024-23898 — Vulnetix

CVE-2024-23898 PUBLISHED

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

EPSS 36.87% · 97.2th percentile

Risk Scores

EPSS Score

36.87%

97.2th percentile

Affected Products

Vendor	Product	Versions
Bitnami	jenkins	2.217.0
Bitnami	jenkins	2.217.0

Exploit Intelligence

CIRCL seen: CVE-2024-23898 (circl-sighting)
CIRCL seen: CVE-2024-23898 (circl-sighting)
CIRCL published-proof-of-concept: CVE-2024-23898 (circl-sighting)
CIRCL seen: CVE-2024-23898 (circl-sighting)
CIRCL seen: CVE-2024-23898 (circl-sighting)
CIRCL published-proof-of-concept: CVE-2024-23898 (circl-sighting)
CIRCL seen: CVE-2024-23898 (circl-sighting)
A proof of concept cross-site WebSocket hijacking exploit for CVE-2024-23898 — a vulnerability affecting Jenkins versions 2.217-2.441. For educational use in the Hacking & Offensive Security course at Carnegie Mellon University. (github-poc-repo)
A proof of concept cross-site WebSocket hijacking exploit for CVE-2024-23898 — a vulnerability affecting Jenkins versions 2.217-2.441. For educational use in the Hacking & Offensive Security course at Carnegie Mellon University. (github-poc-repo)
A proof of concept cross-site WebSocket hijacking exploit for CVE-2024-23898 — a vulnerability affecting Jenkins versions 2.217-2.441. For educational use in the Hacking & Offensive Security course at Carnegie Mellon University. (github-poc-repo)

…and 20 more exploits

Timeline

Jan 24, 2024 CVE Published
Jan 24, 2024 PoC Published
Jan 26, 2024 CVE Updated
Jan 26, 2024 PoC Published
Jan 28, 2024 PoC Published
Jan 29, 2024 PoC Published
Jan 31, 2024 EPSS Score
Feb 18, 2024 PoC Published
Feb 20, 2024 PoC Published
Mar 26, 2024 EPSS Score
Apr 23, 2024 EPSS Score
Jun 17, 2024 EPSS Score

References

Open in Interactive Console →