CVE-2024-23898
highpriority · attend · 69EPSS 0.672 · 99 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-26
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
affected products (18)
Products and version ranges known to be affected.
- Maven org.jenkins-ci.main:jenkins-core2.217 → 2.426.3osvUSpkg:maven/org.jenkins-ci.main/jenkins-core
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-0199Jenkins: Mehrere SchwachstellenDeutsch2024-01-24csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Cross-Site Scripting (XSS)-Angriffe durchzuführen.
- GHSA-53ph-2r2x-vqw8Cross-site WebSocket hijacking vulnerability in the Jenkins CLI2024-01-24ghsa · osvUS
Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication functionality, like HTTP Basic authentication with API tokens, or session cookies. This endpoint is enabled when running on a version of Jetty for which Jenkins supports WebSockets. This is the case when using the provided native installers, packages, or the Docker containers, as well as when running Jenkins with the command java -jar jenkins.war. Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability.
- BIT-jenkins-2024-238982024-03-06vendor · osvUS
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2024/01/24/6cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-23898/cnnvd
- https://vigilance.fr/vulnerability/Jenkins-Core-two-vulnerabilities-43367cnnvd
- https://www.auscert.org.au/bulletins/ESB-2024.0495cnnvd
- https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315cnnvd
- http://www.openwall.com/lists/oss-security/2024/01/24/6enisa_euvd
- https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315enisa_euvd
- https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan