Skip to content
Sign in
8.8 High

CVE-2024-23898 Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin…

Description

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Affected products and versions

Product Affected versions Fixed in
Jenkins 2.442 earliest → < 2.442 2.442
Jenkins 2.440 earliest → < 2.440.1 2.440.1
Jenkins 2.426 earliest → < 2.426.3 2.426.3

Other CVEs of Jenkins

The 153 CVEs of Jenkins →
CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the… 4.3 Medium CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read… 4.3 Medium CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing… 8.8 High CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar… 5.4 Medium
Track this CVE