Description

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

Classification

CVE ID: CVE-2024-43044

CVSS Base Severity: HIGH

CVSS Base Score: 8.8

Affected Products

Vendor: Jenkins Project

Product: Jenkins

Exploit Prediction Scoring System (EPSS)

EPSS Score: 46.17% (probability of being exploited)

EPSS Percentile: 97.41% (scored less or equal to compared to others)

EPSS Date: 2025-04-12 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: none

SSVC Technical Impact: partial

SSVC Automatable: false

References

https://nvd.nist.gov/vuln/detail/CVE-2024-43044
https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3430

Timeline