Description

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".

Remediation

References

CVE-2024-43045

Related Vulnerabilities

MySQL CVE-2022-21249 Vulnerability (CVE-2022-21249)

MODX Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-20756)

ZenCart Inclusion of Functionality from Untrusted Control Sphere Vulnerability (CVE-2024-5762)

WordPress Plugin Post Views Count (Support caching plugins!) Cross-Site Scripting (3.0.2)

WordPress Plugin WP-Contact Multiple Cross-Site Scripting Vulnerabilities (1.0)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities CWE-862 CVE-2024-43045