CVE-2024-23900 Path traversal vulnerability in Jenkins Matrix Project Plugin

What is CVE-2024-23900?

CVE-2024-23900 is a medium-severity path traversal vulnerability in Jenkins Matrix Project Plugin, published on 24 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

Which versions are affected by CVE-2024-23900?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:matrix-project. It affects 1 product.

Products include Jenkins Matrix Project.

How do I fix CVE-2024-23900?

Upgrade org.jenkins-ci.plugins:matrix-project to 822.824.v14451b or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-23900 being exploited?

There is no known exploitation of CVE-2024-23900 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Matrix Project Plugin

• CVE-2019-1003031 Script security sandbox bypass in Matrix Project Plugin Critical 9.9
• CVE-2022-20615 Stored XSS vulnerability in Matrix Project Plugin Medium 5.4
• CVE-2020-2224 Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin Medium 5.4
• CVE-2020-2225 Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cjgm-9vc9-56mx.