CVE-2024-23900

Medium

Description

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

SeverityMedium

CVSS4.3

Exploit probability—

Product

Jenkins Matrix Project

PublishedJan 24, 2024

First seenJan 24, 2024

How to fix

Update

org.jenkins-ci.plugins:matrix-project822.824.v14451b or later

Vendor advisories

jenkins.io/security/advisory/2024-01-24/#SECURITY-3289

Affected products

Product	Affected versions	Fixed in
jenkins matrix_project	v ≤ 822.v01b_8c85d16d2	—
org.jenkins-ci.plugins:matrix-projectMaven	v < 822.824.v14451b	822.824.v14451b

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.