CVE-2024-43044

highPriorität · beachten · 55EPSS 0.288 · 98. PerzentilExploit · PoCDEEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

5 exploits · PoC

Likely / severe?

28.8% (98th) EPSS

CVSS 8.8 · high

Is it mine?

282 products

Prüfe deine Angriffsfläche

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenjenkins-0:2.462.1.1723440104-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.15redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:5405
Behobenjenkins-0:2.462.1.1723440104-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.15redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:5405
Behobenjenkins-2-plugins-0:4.15.1723440333-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.15redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:5405
Behobenjenkins-2-plugins-0:4.15.1723440333-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.15redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:5405
Behobenjenkins-0:2.462.1.1723550696-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:5410
Behobenjenkins-0:2.462.1.1723550696-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:5410
Behobenjenkins-2-plugins-0:4.12.1723550778-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:5410
Behobenjenkins-2-plugins-0:4.12.1723550778-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:5410
Workaroundjenkins-0:2.462.1.1723440104-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.15redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Workaroundjenkins-0:2.462.1.1723440104-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.15redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Workaroundjenkins-2-plugins-0:4.15.1723440333-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.15redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Workaroundjenkins-2-plugins-0:4.15.1723440333-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.15redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Workaroundjenkins-0:2.462.1.1723550696-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Workaroundjenkins-0:2.462.1.1723550696-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Workaroundjenkins-2-plugins-0:4.12.1723550778-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Workaroundjenkins-2-plugins-0:4.12.1723550778-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 8.3–9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.19criticalAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-754USprimärCWE-200USCWE-22USCWE-22USCWE-22USCWE-754US

Exploits (5)

Öffentlicher Proof-of-Concept- und Exploit-Code.

DACC4/CVE-2024-43044-jenkins-credsDACC4/CVE-2024-43044-jenkins-credsPoC · poc_in_github
HwMex0/CVE-2024-43044The script checks Jenkins endpoints for CVE-2024-43044 by retrieving the Jenkins version from the innstance and comparing it against known vulnerable version ranges.PoC · poc_in_github
convisolabs/CVE-2024-43044-jenkinsExploit for the vulnerability CVE-2024-43044 in JenkinsPoC · poc_in_github
jenkinsci-cert/SECURITY-3430This repository provides a workaround preventing exploitation of SECURITY-3430 / CVE-2024-43044PoC · poc_in_github
v9d0g/CVE-2024-43044-POCCVE-2024-43044的利用方式PoC · poc_in_github

betroffene Produkte (282)

Betroffene Produkte und Versionsbereiche.

IBM InfoSphere Information Serveralle Versionencert_bundDEcpe:/a:ibm:infosphere_information_server:-
Oracle Communications 10.0.0alle Versionencert_bundDEcpe:/a:oracle:communications:10.0.0
Oracle Communications 12.11.0alle Versionencert_bundDEcpe:/a:oracle:communications:12.11.0
Oracle Communications 12.6.1.0.0alle Versionencert_bundDEcpe:/a:oracle:communications:12.6.1.0.0
Oracle Communications 14.0alle Versionencert_bundDEcpe:/a:oracle:communications:14.0
Oracle Communications 14.0.0alle Versionencert_bundDEcpe:/a:oracle:communications:14.0.0
Oracle Communications 14.0.0.1alle Versionencert_bundDEcpe:/a:oracle:communications:14.0.0.1
Oracle Communications 15.0.0alle Versionencert_bundDEcpe:/a:oracle:communications:15.0.0
Oracle Communications 15.0.0.0.0alle Versionencert_bundDEcpe:/a:oracle:communications:15.0.0.0.0
Oracle Communications 15.0.1alle Versionencert_bundDEcpe:/a:oracle:communications:15.0.1
Oracle Communications 15.0.2alle Versionencert_bundDEcpe:/a:oracle:communications:15.0.2
Oracle Communications 17.0.1alle Versionencert_bundDEcpe:/a:oracle:communications:17.0.1
Oracle Communications 22.4.0alle Versionencert_bundDEcpe:/a:oracle:communications:22.4.0
Oracle Communications 23.4.0alle Versionencert_bundDEcpe:/a:oracle:communications:23.4.0
Oracle Communications 23.4.2alle Versionencert_bundDEcpe:/a:oracle:communications:23.4.2
Oracle Communications 23.4.3alle Versionencert_bundDEcpe:/a:oracle:communications:23.4.3
Oracle Communications 23.4.4alle Versionencert_bundDEcpe:/a:oracle:communications:23.4.4
Oracle Communications 24.1.0alle Versionencert_bundDEcpe:/a:oracle:communications:24.1.0
Oracle Communications 24.1.0.0.0alle Versionencert_bundDEcpe:/a:oracle:communications:24.1.0.0.0
Oracle Communications 24.1.1alle Versionencert_bundDEcpe:/a:oracle:communications:24.1.1

20 von 282 angezeigt

Advisories (9)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2024-0414Kwetsbaarheden verholpen in Oracle CommunicationsNL2024-10-17csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse Communications producten en systemen.
NCSC-2025-0124Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-04-16csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Communications producten, waaronder de Cloud Native Core en Policy Management.
RHSA-2024:5405Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update2024-08-14csaf · redhat_csafUS
An update for OpenShift Jenkins is now available for Red Hat Product OCP Tools 4.15. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2024:5410Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update2024-08-14csaf · redhat_csafUS
An update for OpenShift Jenkins is now available for Red Hat Product OCP Tools 4.12. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2024-1795Jenkins: Mehrere SchwachstellenDeutsch2024-08-07csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.
WID-SEC-W-2024-3195Oracle Communications: Mehrere SchwachstellenDeutsch2024-10-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2025-0823Oracle Communications: Mehrere SchwachstellenDeutsch2025-04-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-h856-ffvv-xvr4Jenkins Remoting library arbitrary file read vulnerability2024-08-07ghsa · osvUS
Jenkins uses the Remoting library (typically `agent.jar` or `remoting.jar`) for the communication between controller and agents. This library allows agents to load classes and classloader resources from the controller, so that Java objects sent from the controller (build steps, etc.) can be executed on agents. In addition to individual class and resource files, Remoting also allows Jenkins plugins to transmit entire jar files to agents using the `Channel#preloadJar` API. As of publication of this advisory, this feature is used by the following plugins distributed by the Jenkins project: bouncycastle API, Groovy, Ivy, TeamConcert In Remoting 3256.v88a_f6e922152 and earlier, except 3206.3208.v409508a_675ff and 3248.3250.v3277a_8e88c9b_, included in Jenkins 2.470 and earlier, LTS 2.452.3 and earlier, calls to `Channel#preloadJar` result in the retrieval of files from the controller by the agent using `ClassLoaderProxy#fetchJar`. Additionally, the implementation of `ClassLoaderProxy#fetchJar` invoked on the controller does not restrict paths that agents could request to read from the controller file system. This allows agent processes, code running on agents, and attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller file system. The Remoting library in Jenkins 2.471, LTS 2.452.4, LTS 2.462.1 now sends jar file contents with `Channel#preloadJar` requests, the only use case of `ClassLoaderProxy#fetchJar` in agents, so that agents do not need to request jar file contents from controllers anymore. To retain compatibility with older versions of Remoting in combination with the plugins listed above, `ClassLoaderProxy#fetchJar` is retained and otherwise unused, just deprecated. Its implementation in Jenkins 2.471, LTS 2.452.4, LTS 2.462.1 was changed so that it is now limited to retrieving jar files referenced in the core classloader or any plugin classloader.
BIT-jenkins-2024-430442024-08-09vendor · osvUS
Jenkins LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl redhat_csaf NVD CVE.org MITRE

veröffentlicht 2024-08-07geändert 2026-06-17

verwandt (782)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2025-39682US	critical9.8OT kritisch	3.25% (88th)	KEV	2025-09-05
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contig…
CVE-2024-3393US	high7.5OT kritisch	29.1% (98th)	KEV	2024-12-27
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data p…
CVE-2023-41993US	high8.8OT kritisch	24.3% (98th)	KEV	2023-09-21
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that t…
CVE-2023-41992US	high7.8OT kritisch	9.52% (95th)	KEV	2023-09-21
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate thei…
CVE-2021-3560US	high7.8OT kritisch	23.7% (98th)	KEV	2022-02-16
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be us…

+777 weitere

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan