VDB
CVE-2024-47804
CVE-2024-47804
PUBLISHED
CVSS 4.300000190734863 MEDIUM
If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.
EPSS 0.67% · 51.7th percentile
Risk Scores
CVSS 3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score
0.67%
51.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | jenkins | 0 |
| Bitnami | jenkins | 0 |
Timeline
- Oct 2, 2024 CVE Published
- Oct 3, 2024 EPSS Score
- Oct 5, 2024 Coalition ESS Score
- Oct 23, 2024 EPSS Score
- Nov 12, 2024 EPSS Score
- Nov 14, 2024 Coalition ESS Score
- Dec 3, 2024 EPSS Score
- Dec 23, 2024 EPSS Score
- Dec 28, 2024 Coalition ESS Score
- Feb 1, 2025 EPSS Score
- Feb 21, 2025 EPSS Score
- Mar 13, 2025 EPSS Score