Read the docs
TI-2024-28733 Aliases CVE-2024-43044GHSA-h856-ffvv-xvr4

Improper check for unusual conditions in Jenkins

Priority MEDIUM 61CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.28782 98th percentileScored 2026-11-07
Fix Partial Jenkins (Jenkins Project): 2.452.4, 2.462.1, 2.471org.jenkins-ci.main:remoting (Maven): 3206.3208, 3248.3250, 3256.3258+1 more productRed Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins—2.452.4, 2.462.1, 2.471Patch availableCNA
—org.jenkins-ci.main:remoting (Maven)before 3206.32083206.3208Patch availableGHSA-h856-ffvv-xvr4
—org.jenkins-ci.main:remoting (Maven)3248 to before 3248.32503248.3250Patch availableGHSA-h856-ffvv-xvr4
—org.jenkins-ci.main:remoting (Maven)3256 to before 3256.32583256.3258Patch availableGHSA-h856-ffvv-xvr4
—org.jenkins-ci.main:jenkins-core (Maven)before 2.452.42.452.4Patch availableGHSA-h856-ffvv-xvr4
—org.jenkins-ci.main:jenkins-core (Maven)2.460 to before 2.462.12.462.1Patch availableGHSA-h856-ffvv-xvr4
—org.jenkins-ci.main:jenkins-core (Maven)2.470 to before 2.4712.471Patch availableGHSA-h856-ffvv-xvr4
  • Jenkins VendorJenkins Affected — Fixed in 2.452.4, 2.462.1, 2.471 Patch available CNA
  • org.jenkins-ci.main:remoting (Maven) Vendor— Affected before 3206.3208 Fixed in 3206.3208 Patch available GHSA-h856-ffvv-xvr4
  • org.jenkins-ci.main:remoting (Maven) Vendor— Affected 3248 to before 3248.3250 Fixed in 3248.3250 Patch available GHSA-h856-ffvv-xvr4
  • org.jenkins-ci.main:remoting (Maven) Vendor— Affected 3256 to before 3256.3258 Fixed in 3256.3258 Patch available GHSA-h856-ffvv-xvr4
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.452.4 Fixed in 2.452.4 Patch available GHSA-h856-ffvv-xvr4
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.460 to before 2.462.1 Fixed in 2.462.1 Patch available GHSA-h856-ffvv-xvr4
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.470 to before 2.471 Fixed in 2.471 Patch available GHSA-h856-ffvv-xvr4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*before 2.452.4VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*before 2.471VulnerableJenkins
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions before 2.452.4 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* Versions before 2.471 Vulnerable ·Jenkins

Remediation

  • Fix · CNA Jenkins (Jenkins Project) Fixed in 2.452.4, 2.462.1, 2.471
  • Fix · GHSA-h856-ffvv-xvr4 org.jenkins-ci.main:remoting (Maven) Fixed in 3206.3208 Advisory →
  • Fix · GHSA-h856-ffvv-xvr4 org.jenkins-ci.main:remoting (Maven) Fixed in 3248.3250 Advisory →
  • Fix · GHSA-h856-ffvv-xvr4 org.jenkins-ci.main:remoting (Maven) Fixed in 3256.3258 Advisory →
  • Fix · GHSA-h856-ffvv-xvr4 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.452.4 Advisory →
  • Fix · GHSA-h856-ffvv-xvr4 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.462.1 Advisory →
  • Fix · GHSA-h856-ffvv-xvr4 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.471 Advisory →

Red Hat 4 advisories

  • RHSA-2024:5411 Released 2024-08-14 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1723225212-1.el8, jenkins-2.462.1.1723225151-3.el8
  • RHSA-2024:5410 Released 2024-08-14 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1723550778-1.el8, jenkins-2.462.1.1723550696-3.el8
  • RHSA-2024:5406 Released 2024-08-14 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1723446018-1.el8, jenkins-2.462.1.1723445923-3.el8
Show 1 more Red Hat advisories
  • RHSA-2024:5405 Released 2024-08-14 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.15 jenkins-2-plugins-4.15.1723440333-1.el8, jenkins-2.462.1.1723440104-3.el8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Jenkins — Jenkins Security Advisory 2024-08-07

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2024:5410
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2024:5406
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2024:5411
OpenShift Developer Tools and Services for OCP 4.15Fixed RHSA-2024:5405

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-43044
  2. 2026-10-03 Alias added: GHSA-h856-ffvv-xvr4

References

Advisory 2

Other 7

  • TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
  • TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
See all 293 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences