VDB
CVE-2024-47804
CVE-2024-47804
PUBLISHED
CVSS 4.300000190734863 MEDIUM
If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.
EPSS 0.67% · 49.6th percentile
Risk Scores
CVSS 3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score
0.67%
49.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | jenkins | 0 |
| Bitnami | jenkins | 0 |
Timeline
- Oct 2, 2024 CVE Published
- Oct 3, 2024 EPSS Score
- Oct 5, 2024 Coalition ESS Score
- Oct 22, 2024 EPSS Score
- Nov 11, 2024 EPSS Score
- Nov 14, 2024 Coalition ESS Score
- Nov 30, 2024 EPSS Score
- Dec 20, 2024 EPSS Score
- Dec 28, 2024 Coalition ESS Score
- Jan 28, 2025 EPSS Score
- Feb 16, 2025 EPSS Score
- Mar 8, 2025 EPSS Score