CVE-2024-43044 — Improper Check for Unusual or Exceptional Conditions in Jenkins

CWE-754 — Improper Check for Unusual or Exceptional ConditionsCWE-22 — Path Traversal8 documents7 sources
Severity
8.8HIGHNVD
EPSS
65.9%
top 1.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jenkins
Timeline
PublishedAug 7
Latest updateApr 15

Description

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDjenkins/jenkins< 2.452.4+1

🔴Vulnerability Details

3
CVEList
CVE-2024-43044: Jenkins 2↗2024-08-07
▶
GHSA
Jenkins Remoting library arbitrary file read vulnerability↗2024-08-07
▶
OSV
Jenkins Remoting library arbitrary file read vulnerability↗2024-08-07
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Jenkins) — CVE-2024-43044↗2025-04-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: ATS Framework (Jenkins) — CVE-2024-43044↗2024-10-15
▶
Jenkins
Jenkins Security Advisory 2024-08-07↗2024-08-07
▶
Red Hat
jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE↗2024-08-07
▶