8.8 High

CVE-2024-52554 Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides…

Description

Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Shared Library Version Override Plugin 17	earliest → 17.v786074c9fce7	No fix stated
shared_library_version_override 17	earliest → 17.v786074c9fce7	No fix stated

Do you use Jenkins Shared Library Version Override Plugin?

Track this CVE Watch Jenkins Shared Library Version Override Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2024-52554

Timeline

Published November 13, 2024
Last modified November 13, 2024

References

Jenkins Security Advisory 2024-11-13 www.jenkins.io

Track this CVE