High WID-SEC-2024-3563 3 CVEs

Jenkins: Mehrere Schwachstellen

Published Nov 27, 2024 · Updated Mar 4, 2025 · Revision 2 · de-DE

Vendor: Jenkins Project Vendor: Red Hat Product: Enterprise Linux Product: Jenkins Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen und einen Denial-of-Service-Zustand zu erzeugen.

Product

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Vulnerabilities 3

High 8.0

CVE-2024-54003 EPSS 81%

Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability

Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.

Jenkins Project Jenkins Simple Queue Plugin io.jenkins.plugins:simple-queue Web / CMS Maven

Nov 27, 2024
Medium 5.3

CVE-2024-47855 EPSS 18%

JSON-lib mishandles an unbalanced comment string

util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.

libjson-java libjson-java net.sf.json-lib:json-lib org.kordamp.json:json-lib-core Debian Ubuntu Maven

Oct 4, 2024
Medium 4.3

CVE-2024-54004

Jenkins Filesystem List Parameter Plugin has Path Traversal vulnerability

Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system.

Jenkins Project Jenkins Filesystem List Parameter Plugin aendter.jenkins.plugins:filesystem-list-parameter-plugin Web / CMS Maven

Nov 27, 2024

Revision history

2025-03-04 #2
Neue Updates von Red Hat aufgenommen
2024-11-27 #1
Initiale Fassung

References

Jenkins Security Advisory vom 2024-11-27
https://www.jenkins.io/security/advisory/2024-11-27/
Red Hat Security Advisory RHSA-2025:2219 vom 2025-03-04
https://access.redhat.com/errata/RHSA-2025:2219
Red Hat Security Advisory RHSA-2025:2220 vom 2025-03-04
https://access.redhat.com/errata/RHSA-2025:2220
Red Hat Security Advisory RHSA-2025:2218 vom 2025-03-04
https://access.redhat.com/errata/RHSA-2025:2218
Red Hat Security Advisory RHSA-2025:2221 vom 2025-03-04
https://access.redhat.com/errata/RHSA-2025:2221
Red Hat Security Advisory RHSA-2025:2223 vom 2025-03-04
https://access.redhat.com/errata/RHSA-2025:2223
Red Hat Security Advisory RHSA-2025:2222 vom 2025-03-04
https://access.redhat.com/errata/RHSA-2025:2222