CVE-2024-23900

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-24 · updated 2026-06-17

Description

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

Affected products

Jenkins project Jenkins Matrix Project Plugin: through 822.v01b_8c85d16d2

References

http://www.openwall.com/lists/oss-security/2024/01/24/6
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289
http://www.openwall.com/lists/oss-security/2024/01/24/6
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289

Get alerted when CVE-2024-23900 or the next vulnerability affects your stack