VDB
CVE-2024-23898
CVE-2024-23898
PUBLISHED
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
EPSS 67.15% · 99.2th percentile
Risk Scores
EPSS Score
67.15%
99.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | jenkins | 2.217.0 |
| Bitnami | jenkins | 2.217.0 |
Timeline
- Jan 24, 2024 CVE Published
- Jan 24, 2024 PoC Published
- Jan 26, 2024 CVE Updated
- Jan 26, 2024 PoC Published
- Jan 28, 2024 PoC Published
- Jan 29, 2024 PoC Published
- Jan 31, 2024 EPSS Score
- Feb 18, 2024 PoC Published
- Feb 20, 2024 PoC Published
- Mar 26, 2024 EPSS Score
- Apr 23, 2024 EPSS Score
- Jun 17, 2024 EPSS Score