Main Vulnerability Database Vulnerabilities #VU95780

Improper access control in Jenkins and Jenkins LTS - CVE-2024-43044

Published: August 12, 2024 / Updated: August 30, 2024

Vulnerability identifier: #VU95780

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-43044

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the "ClassLoaderProxy#fetchJar" method in the Remoting library. A remote attacker can read arbitrary files on the Jenkins controller file system, leading to arbitrary code execution.

Affected software

Jenkins
Jenkins LTS
Oracle Communications Policy Management
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Automated Test Suite
Oracle Communications Cloud Native Core Network Repository Function

How to mitigate CVE-2024-43044

Install updates from vendor's website.

Jenkins - update to 2.471
Jenkins LTS - addressed in versions 2.452.4, 2.462.1

Links to Public Exploits and PoC-codes

External References

https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3430