CVE-2024-52550
published 2024-11-13CVE-2024-52550: Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a…
PriorityP340high8CVSS 3.1
AVNACLPRLUIRSUCHIHAH
EPSS
0.44%
36.0th percentile
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | authorize_project_plugin | — | — |
| jenkins | declarative_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | ivytrigger_plugin | — | — |
| jenkins | openid_connect_authentication_plugin | — | — |
| jenkins | pipeline | < 3975.3977.v478dd9e956c3 | 3975.3977.v478dd9e956c3 |
| jenkins | pipeline | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | shared_library_version_override_plugin | — | — |
| jenkins_project | jenkins_pipeline_groovy_plugin | <= 3975.v567e2a_1ffa_22 | — |
| jenkins_project | jenkins_pipeline_groovy_plugin | — | — |
CVSS provenance
nvdv3.18.0HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
vendor_redhat8.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin
osv·2024-11-13
CVE-2024-52550 [HIGH] Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin
Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Groovy Plugin 3993.v3e20a_37282f8 refuses to rebuild a build whose main (Jenkinsfile) script is unapproved.
GHSA
Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin
ghsa·2024-11-13
CVE-2024-52550 [HIGH] CWE-285 Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin
Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Groovy Plugin 3993.v3e20a_37282f8 refuses to rebuild a build whose main (Jenkinsfile) script is unapproved.
Jenkins
Jenkins Security Advisory 2024-11-13
vendor_jenkins·2024-11-13·CVSS 4.3
CVE-2022-46751 [MEDIUM] Jenkins Security Advisory 2024-11-13
Title: Jenkins Security Advisory 2024-11-13
Jenkins Security Advisory 2024-11-13
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Authorize Project
Plugin
IvyTrigger
Plugin
OpenId Connect Authentication
Plugin
Pipeline: Declarative
Plugin
Pipeline: Groovy
Plugin
Script Security
Plugin
Shared L
Red Hat
jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines
vendor_redhat·2024-11-13·CVSS 8.0
CVE-2024-52550 [HIGH] CWE-862 jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines
jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.
A flaw was found in the Jenkins Pipeline: Groovy Plugin (jenkins-plugin/workflow-cps). This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main (Jenkinsfile) script is no longer approved, bypassing script approval checks via the rebuild action.
Statement: This vulnerability is considered of important severity rather than moderate because it allows attackers with
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-13
Published