CVE-2024-23898

Summary

CVE-2024-23898 is a newly disclosed vulnerability affecting Jenkins versions 2.217 to 2.441 and LTS 2.222.1 to 2.426.2. This issue stems from the lack of origin validation for requests made through the CLI WebSocket endpoint, rendering the Jenkins controller susceptible to cross-site WebSocket hijacking (CSWSH) attacks. Attackers exploiting this vulnerability can execute arbitrary CLI commands, potentially resulting in unauthorized access, data theft, or system compromise. Users are strongly urged to update their Jenkins installations to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.