CVE-2024-52549 Missing permission check in Jenkins Script Security Plugin

What is CVE-2024-52549?

CVE-2024-52549 is a medium-severity vulnerability in Jenkins Script Security Plugin, published on 13 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.

Weakness: CWE-862

Which versions are affected by CVE-2024-52549?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:script-security. It affects 1 product.

Products include Jenkins Script Security.

How do I fix CVE-2024-52549?

Upgrade org.jenkins-ci.plugins:script-security to 1368.vb or later.

Is CVE-2024-52549 being exploited?

There is no known exploitation of CVE-2024-52549 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Script Security Plugin

• CVE-2019-1003029 Jenkins Script Security Plugin Sandbox Bypass Exploited Critical 9.9
• CVE-2022-43401 Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin Critical 9.9
• CVE-2022-43403 Jenkins Script Security Plugin sandbox bypass vulnerability Critical 9.9
• CVE-2022-43404 Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin Critical 9.9
• CVE-2020-2279 Sandbox bypass vulnerability in Jenkins Script Security Plugin Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jv82-75fh-23r7.