Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2024/01/24/6 | Mailing List |
| https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3040 | Vendor Advisory |
Configurations
History
31 Jan 2024, 17:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:jenkins:github_branch_source:*:*:*:*:*:jenkins:*:* | |
| References | () http://www.openwall.com/lists/oss-security/2024/01/24/6 - Mailing List | |
| References | () https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3040 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
24 Jan 2024, 18:45
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-24 18:15
Updated : 2024-02-05 00:22
NVD link : CVE-2024-23901
Mitre link : CVE-2024-23901
CVE.ORG link : CVE-2024-23901
JSON object : View
Products Affected
jenkins
- github_branch_source
CWE