VDB
CVE-2024-23898
CVE-2024-23898
PUBLISHED
CVSS 8.800000190734863 HIGH
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
EPSS 67.15% · 99.2th percentile
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
67.15%
99.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | jenkins | 2.217.0 |
| Bitnami | jenkins | 2.217.0 |
Timeline
- Jan 24, 2024 CVE Published
- Jan 24, 2024 PoC Published
- Jan 26, 2024 CVE Updated
- Jan 26, 2024 PoC Published
- Jan 28, 2024 PoC Published
- Jan 29, 2024 PoC Published
- Jan 31, 2024 EPSS Score
- Feb 18, 2024 PoC Published
- Feb 20, 2024 PoC Published
- Mar 26, 2024 EPSS Score
- Apr 23, 2024 EPSS Score
- Jun 17, 2024 EPSS Score