Most recent entries from all

bdu:2024-08496

BIT-jenkins-2024-47804

Affected: Bitnami: jenkins

If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.

EUVD-2026-222779

fkie_cve-2024-47804

If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.

GHSA-f9qj-77q2-h5c5 — Jenkins item creation restriction bypass vulnerability

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins provides APIs for fine-grained control of item creation:

- Authorization strategies can prohibit the creation of items of a given type in a given item group (`ACL#hasCreatePermission2`).

- Item types can prohibit creation of new instances in a given item group (`TopLevelItemDescriptor#isApplicableIn(ItemGroup)`).

If an attempt is made to create an item of a prohibited type through the Jenkins CLI or the REST API and either of the above checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk.

This allows attackers with Item/Create permission to bypass these restrictions, creating a temporary item. With Item/Configure permission, they can also save the item to persist it.

If an attempt is made to create an item of a prohibited type through the Jenkins CLI or the REST API and either of the above checks fail, Jenkins 2.479, LTS 2.462.3 does not retain the item in memory.

RHSA-2024:8884 — Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 Openshift Jenkins security update

angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication spring-expression: Denial of service when processing a specially crafted Spring Expression Language expression jenkins: Exposure of multi-line secrets through error messages jenkins: Item creation restriction bypass vulnerability

WID-SEC-W-2024-3071 — Jenkins: Mehrere Schwachstellen

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Jenkins und verschiedenen Jenkins Plugins ausnutzen, um Informationen offenzulegen Sicherheitsvorkehrungen zu umgehen oder seine Rechte zu erweitern.