CVE-2024-52554

High

Description

Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection.

SeverityHigh

CVSS8.8

Exploit probability—

Product

Jenkins Shared Library Version Override

PublishedNov 13, 2024

First seenNov 13, 2024

Weakness typeCWE-862Missing authorization

How to fix

Update

io.jenkins.plugins:shared-library-version-override19.v3a or later

Vendor advisories

jenkins.io/security/advisory/2024-11-13/#SECURITY-3466

Affected products

Product	Affected versions	Fixed in
jenkins shared_library_version_override	v ≤ 17.v786074c9fce7	—
io.jenkins.plugins:shared-library-version-overrideMaven	v < 19.v3a	19.v3a

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.