CVE-2024-52550

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-13 · updated 2026-06-17
Weakness: CWE-354

Description

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.

Affected products

Jenkins project Jenkins Pipeline: Groovy Plugin: before 3975.3977.v478dd9e956c3; 3990.vd281dd77a_388 — fixed in 3975.3977.v478dd9e956c3

How to fix

Upgrade to a fixed version: Jenkins project Jenkins Pipeline: Groovy Plugin 3975.3977.v478dd9e956c3. Check the vendor advisory for mitigations.

References

https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362

Get alerted when CVE-2024-52550 or the next vulnerability affects your stack