Description
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.462.1.1723225151-3.el8 | RHSA-2024:5411, RHSA-2024:5410, RHSA-2024:5406 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1723550778-1.el8 | RHSA-2024:5411, RHSA-2024:5410, RHSA-2024:5406 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
convisolabs/CVE-2024-43044-jenkins ★ 184 · Aug 23, 2024
Exploit for the vulnerability CVE-2024-43044 in Jenkins
-
HwMex0/CVE-2024-43044 ★ 21 · Aug 8, 2024
The script checks Jenkins endpoints for CVE-2024-43044 by retrieving the Jenkins version from the innstance and comparing it against known vulnerable version ranges.
-
v9d0g/CVE-2024-43044-POC ★ 20 · Aug 13, 2024
CVE-2024-43044的利用方式
-
jenkinsci-cert/SECURITY-3430 ★ 2 · Aug 8, 2024
This repository provides a workaround preventing exploitation of SECURITY-3430 / CVE-2024-43044
-
DACC4/CVE-2024-43044-jenkins-creds ★ 0 · Jan 12, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.452.4 | 2.452.4 | GHSA-h856-ffvv-xvr4 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.460, < 2.462.1 | 2.462.1 | GHSA-h856-ffvv-xvr4 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.470, < 2.471 | 2.471 | GHSA-h856-ffvv-xvr4 |
| Maven | org.jenkins-ci.main:remoting | < 3206.3208 | 3206.3208 | GHSA-h856-ffvv-xvr4 |
| Maven | org.jenkins-ci.main:remoting | >= 3248, < 3248.3250 | 3248.3250 | GHSA-h856-ffvv-xvr4 |
| Maven | org.jenkins-ci.main:remoting | >= 3256, < 3256.3258 | 3256.3258 | GHSA-h856-ffvv-xvr4 |
Advisories 9
- RHSA-2024:5411 Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2024:5406 Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- WID-SEC-2025-0823 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2024:5410 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Feb 18, 2026
- RHSA-2024:5405 Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Feb 18, 2026
- NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-1795 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 14, 2024
References
- Jenkins Security Advisory 2024-08-07 vendor-advisory