« Volver al listado

CVE-2024-52549

Estado: AnalizadaMedia (4.3)—

Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jenkins — Script Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52549",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52549",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-13T21:35:27.415468Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "affectedData": [
        {
          "vendor": "Jenkins Project",
          "product": "Jenkins Script Security Plugin",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "maven",
              "lessThanOrEqual": "1362.v67dc1f0e1b_b_3"
            },
            {
              "status": "affected",
              "version": "1365.v4778ca_84b_de5"
            },
            {
              "status": "affected",
              "version": "1366.vd44b_49a_5c85c",
              "versionType": "maven",
              "lessThanOrEqual": "1367.vdf2fc45f229c"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-13T21:15:29.233",
  "references": [
    {
      "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3447",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "jenkinsci-cert@googlegroups.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system."
    },
    {
      "lang": "es",
      "value": "El complemento de seguridad de script de Jenkins 1367.vdf2fc45f229c y anteriores, excepto 1365.1367.va_3b_b_89f8a_95b_ y 1362.1364.v4cf2dc5d8776, no realiza una verificación de permisos en un método que implementa la validación de formulario, lo que permite a los atacantes con permiso general/de lectura verificar la existencia de archivos en el sistema de archivos del controlador."
    }
  ],
  "lastModified": "2026-06-17T08:07:26.167",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E630C9AA-BF77-4C85-AB62-8448AE162A6F",
              "versionEndExcluding": "1362.1364.v4cf2dc5d8776"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE1C67AE-AD1A-4327-B76E-906EECB477E6",
              "versionEndExcluding": "1367.vdf2fc45f229c",
              "versionStartIncluding": "1366.vd44b_49a_5c85c"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:script_security:1365.v4778ca_84b_de5:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57795096-41A2-455F-A412-C43F84270398"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "jenkinsci-cert@googlegroups.com"
}