CVE-2024-43044

high · 8.8

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

8.8

CVSS

28.8%

EPSS (exploit prob.)

98th

EPSS percentile

2024-08-07

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-754

Affected products

Vendor	Product	Affected versions
jenkins	jenkins	< 2.452.4
jenkins	jenkins	< 2.471

Check a specific version with /api/v1/cve/match.

References

https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3430

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-43044