vulnerability

Jenkins Advisory 2024-01-24: CVE-2024-23901: Shared projects are unconditionally discovered by GitLab Branch Source Plugin

Severity
6
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:N)
Published
Jan 25, 2024
Added
Jan 25, 2024
Modified
Jan 28, 2025

Description

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group.

Solution(s)

jenkins-lts-upgrade-2_426_3jenkins-upgrade-2_442
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.