Description
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.50, < 2.414.2 | 2.414.2 | GHSA-55wp-3pq4-w8p9 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.415, < 2.424 | 2.424 | GHSA-55wp-3pq4-w8p9 |
Advisories 3
- WID-SEC-2024-0869 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 10, 2025
- WID-SEC-2024-0106 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2023-2411 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 20, 2023