Origin validation error in Jenkins
Priority HIGH 77CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-346.
Summary
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.67151 99th percentileScored 2026-11-08
Fix Partial Jenkins (Jenkins Project): 2.442, 2.426.3, 2.440.1org.jenkins-ci.main:jenkins-core (Maven): 2.426.3, 2.442Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins | — | 2.442, 2.426.3, 2.440.1 | Patch available | CNA |
| — | org.jenkins-ci.main:jenkins-core (Maven) | 2.217 to before 2.426.3 | 2.426.3 | Patch available | GHSA-53ph-2r2x-vqw8 |
| — | org.jenkins-ci.main:jenkins-core (Maven) | 2.427 to before 2.442 | 2.442 | Patch available | GHSA-53ph-2r2x-vqw8 |
| — | org.jenkins-ci.main:jenkins-core (Maven) | — | — | No fix listed | GHSA-53ph-2r2x-vqw8 |
- Jenkins VendorJenkins Affected — Fixed in 2.442, 2.426.3, 2.440.1 Patch available CNA
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.217 to before 2.426.3 Fixed in 2.426.3 Patch available GHSA-53ph-2r2x-vqw8
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.427 to before 2.442 Fixed in 2.442 Patch available GHSA-53ph-2r2x-vqw8
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-53ph-2r2x-vqw8
Remediation
- Fix · CNA Jenkins (Jenkins Project) Fixed in 2.442, 2.426.3, 2.440.1
- Fix · GHSA-53ph-2r2x-vqw8 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.426.3 Advisory →
- Fix · GHSA-53ph-2r2x-vqw8 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.442 Advisory →
Red Hat 3 advisories
- RHSA-2024:0775 Released 2024-02-12 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1706516946-1.el8, jenkins-2.426.3.1706516929-3.el8
- RHSA-2024:0778 Released 2024-02-12 · Red Hat rating ImportantJenkins and Jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1706515741-1.el8, jenkins-2.426.3.1706515686-3.el8
- RHSA-2024:0776 Released 2024-02-12 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1706516346-1.el8, jenkins-2.426.3.1706516254-3.el8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Jenkins — Jenkins Security Advisory 2024-01-24
2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 HIGH
Other records, highest priority first
- TI-2024-15885 Path traversal in JenkinsPriority CRITICAL 100
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 | Fixed | RHSA-2024:0775 |
| OpenShift Developer Tools and Services for OCP 4.12 | Fixed | RHSA-2024:0778 |
| OpenShift Developer Tools and Services for OCP 4.13 | Fixed | RHSA-2024:0776 |
Not affected: 3 products
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
- OpenShift Developer Tools and Services for OCP 4.12
- OpenShift Developer Tools and Services for OCP 4.13
Timeline
- 2026-10-02 Threatist record created from CVE-2024-23898
- 2026-10-03 Alias added: GHSA-53ph-2r2x-vqw8
References
Other 5
- https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
- http://www.openwall.com/lists/oss-security/2024/01/24/6
- https://github.com/jenkinsci/jenkins/commit/de450967f38398169650b55c002f1229a3fcdb1b
- https://github.com/jenkinsci/jenkins
- https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins
More Jenkins vulnerabilities
- TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
- TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2024-23898 · CVE Program
- CVE-2024-23898 · NVD
- FIRST EPSS
- GHSA-53ph-2r2x-vqw8 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-23898 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences