Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2024-43045

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".

VectorNETWORK

PublishedAug 07, 2024, 14:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score6.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.main:jenkins-core(Maven)02.452.4N/A

org.jenkins-ci.main:jenkins-core(Maven)2.4602.462.1N/A

org.jenkins-ci.main:jenkins-core(Maven)2.4702.471N/A

References

https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3349

Weakness Type

CWE-862

CVSS Metrics

Base Score

6.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK