CVE-2024-52549

mediumpriority · track · 0OT risk · elevatedEPSS 0.004 · 28 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.35% (28th) EPSS

CVSS 4.3 · medium

Is it mine?

10 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-22

Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondaryexploitability 2.8 · impact 1.4

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · OSV

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USCWE-862USCWE-862US

affected products (10)

Products and version ranges known to be affected.

Jenkins Jenkins Script Security Plugin <1368.vb_b_402e3547e7all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
jenkins Jenkins≤ Script Security Plugin <1368.vb_b_402e3547e7cert_bundDE
Jenkins Project Jenkins Script Security Plugin≤ 0 ≤1362.v67dc1f0e1b_b_3enisa_euvdEU
Jenkins Project Jenkins Script Security Plugin≤ 1366.vd44b_49a_5c85c ≤1367.vdf2fc45f229cenisa_euvdEU
Jenkins Project Jenkins Script Security Plugin≤ 1365.v4778ca_84b_de5enisa_euvdEU
jenkins script security< 1362.1364.v4cf2dc5d8776nvdUScpe:2.3:a:jenkins:script_security:*:*:*:*:*:*:*:*
jenkins script security= 1365.v4778ca_84b_de5nvdUScpe:2.3:a:jenkins:script_security:*:*:*:*:*:*:*:*
jenkins script security1366.vd44b_49a_5c85c → 1367.vdf2fc45f229cnvdUScpe:2.3:a:jenkins:script_security:*:*:*:*:*:*:*:*
Maven org.jenkins-ci.plugins:script-security< 1368.vbosvUSpkg:maven/org.jenkins-ci.plugins/script-security

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-3456Jenkins Plugins: Mehrere SchwachstellenDeutsch2024-11-13csaf · cert_bundDE
Ein entfernter authentisierter Angreifer oder ein anonymer Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Dateien zu manipulieren, vertrauliche Informationen preiszugeben, beliebigen Code auszuführen, sich erhöhte Rechte zu verschaffen und einen Cross-Site-Scripting-Angriff durchzuführen.
GHSA-jv82-75fh-23r7Missing permission check in Jenkins Script Security Plugin 2024-11-13ghsa · osvUS
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system. This allows attackers with Overall/Read permission to check for the existence of files on the controller file system. Script Security Plugin 1368.vb_b_402e3547e7 requires Overall/Administer permission for the affected form validation method.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2024-11-13modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan