CVE-2024-23900

MEDIUM

Jenkins Matrix Project Plugin <822.v01b_8c85d16d2 - Privilege Escal...

Title source: llm

Description

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

References (2)

Core 2

Core References

Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2024/01/24/6

Vendor Advisory vendor-advisory

https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289

Scores

CVSS v3 4.3

EPSS 0.0006

EPSS Percentile 18.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

Status published

Products (2)

jenkins/matrix_project < 822.v01b_8c85d16d2

org.jenkins-ci.plugins/matrix-project 0 - 822.824.v14451bMaven

Published Jan 24, 2024

Tracked Since Feb 18, 2026