CVE-2024-47804 Affecting jenkins-2.462 package, versions <2.462.3-r0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CHAINGUARDLATEST-JENKINS2462-8161514
- published 3 Oct 2024
- disclosed 2 Oct 2024
How to fix?
Upgrade Chainguard jenkins-2.462 to version 2.462.3-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream jenkins-2.462 package and not the jenkins-2.462 package as distributed by Chainguard.
See How to fix? for Chainguard relevant fixed versions and status.
If an attempt is made to create an item of a type prohibited by ACL#hasCreatePermission2 or TopLevelItemDescriptor#isApplicableIn(ItemGroup) through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.