CVE-2024-52549
Missing permission check in Jenkins Script Security Plugin
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.
- Record
CVE-2024-52549- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2024-3278
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.
- Record
EUVD-2024-3278- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jv82-75fh-23r7
Missing permission check in Jenkins Script Security Plugin
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system. This allows attackers with Overall/Read permission to check for the existence of files on the controller file system. Script Security Plugin 1368.vb_b_402e3547e7 requires Overall/Administer permission for the affected form validation method.
- Record
GHSA-jv82-75fh-23r7- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-306, CWE-862
- Updated
- 2026-11-02
NVD
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.
- Record
CVE-2024-52549- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.
- Record
CVE-2024-52549- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-jv82-75fh-23r7
Missing permission check in Jenkins Script Security Plugin
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system. This allows attackers with Overall/Read permission to check for the existence of files on the controller file system. Script Security Plugin 1368.vb_b_402e3547e7 requires Overall/Administer permission for the affected form validation method.
- Record
GHSA-jv82-75fh-23r7- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-306, CWE-862
- Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2025:2218
Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 Openshift Jenkins security update
- Record
RHSA-2025:2218- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:2219
Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 Openshift Jenkins security update
- Record
RHSA-2025:2219- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:2220
Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 Openshift Jenkins security update
- Record
RHSA-2025:2220- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:2221
Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update
- Record
RHSA-2025:2221- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:2222
Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 Openshift Jenkins security update
- Record
RHSA-2025:2222- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:2223
Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update
- Record
RHSA-2025:2223- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:script-securityMaven |
before 1368.vb | 1368.vb |
org.jenkins-ci.plugins:script-securityMaven |
before 1368.vb, plus listed versions 1.01.0-beta-11.0-beta-21.0-beta-31.0-beta-4 Show 45 moreShow less1.0-beta-51.0-beta-61.11.101.111.121.131.141.151.161.171.181.18.11.191.21.201.211.221.231.241.251.261.271.281.291.29.11.31.301.311.331.341.351.361.371.381.391.41.401.411.421.431.441.44.11.451.46 |
1368.vb |
jenkinsRed Hat:ocp_tools:4.17::el9 From an advisory covering 5 CVEs |
before 0:2.479.3.1739859586-3.el9 | 0:2.479.3.1739859586-3.el9 |
jenkins-2-pluginsRed Hat:ocp_tools:4.17::el9 From an advisory covering 5 CVEs |
before 0:4.17.1739859908-1.el9 | 0:4.17.1739859908-1.el9 |
jenkinsRed Hat:ocp_tools:4.16::el9 From an advisory covering 5 CVEs |
before 0:2.479.3.1739896390-3.el9 | 0:2.479.3.1739896390-3.el9 |
jenkins-2-pluginsRed Hat:ocp_tools:4.16::el9 From an advisory covering 5 CVEs |
before 0:4.16.1739896683-1.el9 | 0:4.16.1739896683-1.el9 |
jenkinsRed Hat:ocp_tools:4.15::el8 From an advisory covering 5 CVEs |
before 0:2.479.3.1740051993-3.el8 | 0:2.479.3.1740051993-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.15::el8 From an advisory covering 5 CVEs |
before 0:4.15.1740052174-1.el8 | 0:4.15.1740052174-1.el8 |
jenkinsRed Hat:ocp_tools:4.14::el8 From an advisory covering 5 CVEs |
before 0:2.479.3.1740109575-3.el8 | 0:2.479.3.1740109575-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.14::el8 From an advisory covering 5 CVEs |
before 0:4.14.1740109868-1.el8 | 0:4.14.1740109868-1.el8 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jenkinsRed Hat:ocp_tools:4.13::el8 From an advisory covering 5 CVEs |
before 0:2.479.3.1740464433-3.el8 | 0:2.479.3.1740464433-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.13::el8 From an advisory covering 5 CVEs |
before 0:4.13.1740464698-1.el8 | 0:4.13.1740464698-1.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 From an advisory covering 6 CVEs |
before 0:2.479.3.1740464431-3.el8 | 0:2.479.3.1740464431-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 From an advisory covering 6 CVEs |
before 0:4.12.1740464689-1.el8 | 0:4.12.1740464689-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-52549 is a medium vulnerability (CVSS 4.3) in Jenkins Script Security, published November 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in org.jenkins-ci.plugins:script-security 1368.vb.
References
jenkins.io/security/advisory/2024-11-13
nvd.nist.gov/vuln/detail/CVE-2024-52549
github.com/advisories/GHSA-jv82-75fh-23r7
access.redhat.com/errata/RHSA-2025:2218
Show 45 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2316421
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2218.json
cve.org/CVERecord?id=CVE-2024-47072
x-stream.github.io/CVE-2024-47072.html
groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
pkg.go.dev/vuln/GO-2025-3372
Left out here: 108 versions. The JSON record has them.