4.3
CVE-2024-52549
- EPSS 0.11%
- Published 13.11.2024 21:15:29
- Last modified 15.11.2024 14:00:09
- Source jenkinsci-cert@googlegroups.co
- Teams watchlist Login
- Open Login
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorJenkins Project
≫
Product
Jenkins Script Security Plugin
Default Statusunaffected
Version <=
1362.v67dc1f0e1b_b_3
Version
0
Status
affected
Version
1365.v4778ca_84b_de5
Status
affected
Version <=
1367.vdf2fc45f229c
Version
1366.vd44b_49a_5c85c
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.11% | 0.294 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.