Description (CNA)
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Jenkins Project / Jenkins | unaffected 0 before 2.217; unaffected 2.442 before *; unaffected 2.426.3 before 2.426.*; unaffected 2.440.1 before 2.440.* |
CWE
No CWE identifiers supplied.
References
- https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315
- https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
- http://www.openwall.com/lists/oss-security/2024/01/24/6
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.