Description
A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins Script Security Plugin | ≤ 1335.vf07d9ce377a_e | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.440.3.1716387933-3.el8 | RHSA-2024:8886, RHSA-2024:4597, RHSA-2024:3636 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1716445211-1.el8 | RHSA-2024:8886, RHSA-2024:4597, RHSA-2024:3636 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
MXWXZ/CVE-2024-34144 ★ 2 · Jul 29, 2024
PoC for CVE-2024-34144
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:script-security | < 1336.vf33a | 1336.vf33a | GHSA-v63g-v339-2673 |
Advisories 6
- RHSA-2024:8886 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:4597 Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:3636 Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:3634 Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:3635 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2024-1018 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2024