UpHeron
All vulnerabilities

Servers and applications

CVE-2024-47804

If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to…

Severity
Medium 4.3
Published
2 Oct 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.462.3, 2.479
Sources
NVD

Affected software

SoftwareAffected versions
JenkinsServers and applications · cpe:a:jenkins:jenkins
  • Every version before 2.462.3
  • Every version before 2.479

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-47804
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-47804