CVE-2024-52551
Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.
- Record
CVE-2024-52551- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
EUVDEUVD-2024-3288
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.
- Record
EUVD-2024-3288- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p2qq-c693-q53w
Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Declarative Plugin 2.2218.v56d0cda_37c72 refuses to restart a build whose main (Jenkinsfile) script is unapproved.
- Record
GHSA-p2qq-c693-q53w- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-276, CWE-285
- Updated
- 2026-11-02
NVD
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.
- Record
CVE-2024-52551- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
OSV
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.
- Record
CVE-2024-52551- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-p2qq-c693-q53w
Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Declarative Plugin 2.2218.v56d0cda_37c72 refuses to restart a build whose main (Jenkinsfile) script is unapproved.
- Record
GHSA-p2qq-c693-q53w- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-276, CWE-285
- Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2025:2218
Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 Openshift Jenkins security update
- Record
RHSA-2025:2218- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:2219
Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 Openshift Jenkins security update
- Record
RHSA-2025:2219- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:2220
Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 Openshift Jenkins security update
- Record
RHSA-2025:2220- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:2221
Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update
- Record
RHSA-2025:2221- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:2222
Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 Openshift Jenkins security update
- Record
RHSA-2025:2222- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:2223
Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update
- Record
RHSA-2025:2223- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkinsci.plugins:pipeline-model-parentMaven |
before 2.2218.v56d0cda | 2.2218.v56d0cda |
org.jenkinsci.plugins:pipeline-model-parentMaven |
before 2.2218.v56d0cda, plus listed versions 0.50.60.70.7.10.8 Show 45 moreShow less0.8.10.8.20.90.9.11.01.0.11.0.21.11.1.11.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.21.2-beta-21.2-beta-31.2-beta-41.2-beta-51.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.31.3.11.3.21.3.31.3.3.11.3.41.3.4.11.3.51.3.61.3.71.3.7-beta-11.3.81.3.91.4.0 |
2.2218.v56d0cda |
jenkinsRed Hat:ocp_tools:4.17::el9 From an advisory covering 5 CVEs |
before 0:2.479.3.1739859586-3.el9 | 0:2.479.3.1739859586-3.el9 |
jenkins-2-pluginsRed Hat:ocp_tools:4.17::el9 From an advisory covering 5 CVEs |
before 0:4.17.1739859908-1.el9 | 0:4.17.1739859908-1.el9 |
jenkinsRed Hat:ocp_tools:4.16::el9 From an advisory covering 5 CVEs |
before 0:2.479.3.1739896390-3.el9 | 0:2.479.3.1739896390-3.el9 |
jenkins-2-pluginsRed Hat:ocp_tools:4.16::el9 From an advisory covering 5 CVEs |
before 0:4.16.1739896683-1.el9 | 0:4.16.1739896683-1.el9 |
jenkinsRed Hat:ocp_tools:4.15::el8 From an advisory covering 5 CVEs |
before 0:2.479.3.1740051993-3.el8 | 0:2.479.3.1740051993-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.15::el8 From an advisory covering 5 CVEs |
before 0:4.15.1740052174-1.el8 | 0:4.15.1740052174-1.el8 |
jenkinsRed Hat:ocp_tools:4.14::el8 From an advisory covering 5 CVEs |
before 0:2.479.3.1740109575-3.el8 | 0:2.479.3.1740109575-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.14::el8 From an advisory covering 5 CVEs |
before 0:4.14.1740109868-1.el8 | 0:4.14.1740109868-1.el8 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jenkinsRed Hat:ocp_tools:4.13::el8 From an advisory covering 5 CVEs |
before 0:2.479.3.1740464433-3.el8 | 0:2.479.3.1740464433-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.13::el8 From an advisory covering 5 CVEs |
before 0:4.13.1740464698-1.el8 | 0:4.13.1740464698-1.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 From an advisory covering 6 CVEs |
before 0:2.479.3.1740464431-3.el8 | 0:2.479.3.1740464431-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 From an advisory covering 6 CVEs |
before 0:4.12.1740464689-1.el8 | 0:4.12.1740464689-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-52551 is a high vulnerability (CVSS 8.0) in Jenkins Project Pipeline: Declarative Plugin, published November 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in org.jenkinsci.plugins:pipeline-model-parent 2.2218.v56d0cda.
References
jenkins.io/security/advisory/2024-11-13
nvd.nist.gov/vuln/detail/CVE-2024-52551
github.com/advisories/GHSA-p2qq-c693-q53w
access.redhat.com/errata/RHSA-2025:2218
Show 45 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2316421
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2218.json
cve.org/CVERecord?id=CVE-2024-47072
x-stream.github.io/CVE-2024-47072.html
groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
pkg.go.dev/vuln/GO-2025-3372
Left out here: 51 versions. The JSON record has them.