Every CVE Search/ Get API key

CVE-2024-52550

Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin

8.0 HighPublic exploitFix available

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.46%Up 0.4 points since Nov 14, 2024
90%50%10%1%

What each source reports

CVE List Score used 8.0

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.

Record
CVE-2024-52550
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-354
Updated
2026-11-02
EUVDEUVD-2024-3284 8.0

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.

Record
EUVD-2024-3284
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-mrpr-vr82-x88r 7.3

Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Groovy Plugin 3993.v3e20a_37282f8 refuses to rebuild a build whose main (Jenkinsfile) script is unapproved.

Record
GHSA-mrpr-vr82-x88r
CVSS 4.0
7.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-285, CWE-354
Updated
2026-11-02
NVD 8.0

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.

Record
CVE-2024-52550
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-354
Updated
2026-11-02
OSV 8.0

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.

Record
CVE-2024-52550
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-mrpr-vr82-x88r 7.3

Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Groovy Plugin 3993.v3e20a_37282f8 refuses to rebuild a build whose main (Jenkinsfile) script is unapproved.

Record
GHSA-mrpr-vr82-x88r
CVSS 4.0
7.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-285, CWE-354
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2025:2218 8.0

Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 Openshift Jenkins security update

Record
RHSA-2025:2218
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:2219 8.0

Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 Openshift Jenkins security update

Record
RHSA-2025:2219
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:2220 8.0

Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 Openshift Jenkins security update

Record
RHSA-2025:2220
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:2221 8.0

Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update

Record
RHSA-2025:2221
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:2222 8.0

Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 Openshift Jenkins security update

Record
RHSA-2025:2222
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:2223 8.0

Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update

Record
RHSA-2025:2223
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins.workflow:workflow-cps
Maven
 before 3993.v3e20a
3993.v3e20a
org.jenkins-ci.plugins.workflow:workflow-cps
Maven
 before 3993.v3e20a, plus listed versions
0.1-beta-10.1-beta-20.1-beta-30.1-beta-40.1-beta-5
Show 45 moreShow less
0.1-beta-60.1-beta-70.1-beta-81.01.0-beta-11.11.101.10-beta-11.10.11.111.11-beta-11.11-beta-21.11-beta-31.11-beta-41.121.12-beta-11.12-beta-21.12-beta-31.131.141.14-beta-11.14.11.14.1-beta-11.14.21.151.15-beta-11.21.31.41.4.11.4.21.4.31.4.3-beta-11.51.61.6-alpha-11.71.7-alpha-11.81.91.9-beta-12.02.12.102.11
3993.v3e20a
jenkins
Red Hat:ocp_tools:4.17::el9
From an advisory covering 5 CVEs
 before 0:2.479.3.1739859586-3.el9
0:2.479.3.1739859586-3.el9
jenkins-2-plugins
Red Hat:ocp_tools:4.17::el9
From an advisory covering 5 CVEs
 before 0:4.17.1739859908-1.el9
0:4.17.1739859908-1.el9
jenkins
Red Hat:ocp_tools:4.16::el9
From an advisory covering 5 CVEs
 before 0:2.479.3.1739896390-3.el9
0:2.479.3.1739896390-3.el9
jenkins-2-plugins
Red Hat:ocp_tools:4.16::el9
From an advisory covering 5 CVEs
 before 0:4.16.1739896683-1.el9
0:4.16.1739896683-1.el9
jenkins
Red Hat:ocp_tools:4.15::el8
From an advisory covering 5 CVEs
 before 0:2.479.3.1740051993-3.el8
0:2.479.3.1740051993-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.15::el8
From an advisory covering 5 CVEs
 before 0:4.15.1740052174-1.el8
0:4.15.1740052174-1.el8
jenkins
Red Hat:ocp_tools:4.14::el8
From an advisory covering 5 CVEs
 before 0:2.479.3.1740109575-3.el8
0:2.479.3.1740109575-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.14::el8
From an advisory covering 5 CVEs
 before 0:4.14.1740109868-1.el8
0:4.14.1740109868-1.el8
Show 4 moreShow less
Affected packages
PackageAffectedFixed
jenkins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 5 CVEs
 before 0:2.479.3.1740464433-3.el8
0:2.479.3.1740464433-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 5 CVEs
 before 0:4.13.1740464698-1.el8
0:4.13.1740464698-1.el8
jenkins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 6 CVEs
 before 0:2.479.3.1740464431-3.el8
0:2.479.3.1740464431-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 6 CVEs
 before 0:4.12.1740464689-1.el8
0:4.12.1740464689-1.el8

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubAnton-ai111/CVE-2024-525502025-04-15

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-52550 is a high vulnerability (CVSS 8.0) in Jenkins Groovy, published November 13, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in org.jenkins-ci.plugins.workflow:workflow-cps 3993.v3e20a.

References

Show 45 moreShow less
This page doesn't list everything

Left out here: 221 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open