CVE-2024-52550

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.

Score

CVSS 3.1 8.0 High

Status

Analyzed - jenkinsci-cert@googlegroups.com

Published

2024-11-13

Last modified

2024-11-26

Weaknesses

CWE-354

Affected products

• Groovy (Jenkins)
• Pipeline\ (Jenkins)
• Jenkins Pipeline Groovy Plugin (Jenkins Project)

References

• https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362