Description
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.426.3.1706515686-3.el8 | RHSA-2024:0778, RHSA-2024:0776, RHSA-2024:0775 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.11.1706516946-1.el8 | RHSA-2024:0778, RHSA-2024:0776, RHSA-2024:0775 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
davidmgaviria/CVE2_Jenkins_RCE ★ 2 · Nov 14, 2024
A proof of concept cross-site WebSocket hijacking exploit for CVE-2024-23898 — a vulnerability affecting Jenkins versions 2.217-2.441. For educational use in the Hacking & Offensive Security course a…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.217, < 2.426.3 | 2.426.3 | GHSA-53ph-2r2x-vqw8 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.427, < 2.442 | 2.442 | GHSA-53ph-2r2x-vqw8 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.441 | — | GHSA-53ph-2r2x-vqw8 |
Advisories 4
- RHSA-2024:0778 Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2024:0776 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2024:0775 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2024-0199 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 20, 2024