Every CVE Search/ Get API key

CVE-2024-23898

Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

8.8 HighPublic exploitFix available

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

67.2%Up 67.1 points since Jan 31, 2024
90%50%10%1%

What each source reports

NVD Score used 8.8

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Record
CVE-2024-23898
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-346
Updated
2026-11-02
CVE List 8.8

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Record
CVE-2024-23898
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-346
Updated
2026-11-02
EUVDEUVD-2024-0256 8.8

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Record
EUVD-2024-0256
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-53ph-2r2x-vqw8 8.8

Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication functionality, like HTTP Basic authentication with API tokens, or session cookies. This endpoint is enabled when running on a version of Jetty for which Jenkins supports WebSockets. This is the case when using the provided native installers, packages, or the Docker containers, as well as when running Jenkins with the command java -jar jenkins.war.

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability.

Record
GHSA-53ph-2r2x-vqw8
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-346
Updated
2026-11-02
OSV 8.8

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Record
CVE-2024-23898
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-53ph-2r2x-vqw8 8.8

Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication functionality, like HTTP Basic authentication with API tokens, or session cookies. This endpoint is enabled when running on a version of Jetty for which Jenkins supports WebSockets. This is the case when using the provided native installers, packages, or the Docker containers, as well as when running Jenkins with the command java -jar jenkins.war.

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability.

Record
GHSA-53ph-2r2x-vqw8
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-346
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2024:0775 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record
RHSA-2024:0775
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:0776 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record
RHSA-2024:0776
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:0778 9.8

Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update

Record
RHSA-2024:0778
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-jenkins-2024-23898 No score

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Record
BIT-jenkins-2024-23898
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.main:jenkins-core
Maven
 2.217 to 2.426.2
2.426.3
org.jenkins-ci.main:jenkins-core
Maven
 2.427 to 2.440
2.442
org.jenkins-ci.main:jenkins-core
Maven
 2.441 to 2.441 None known
jenkins
Bitnami
 2.217.0 up to 2.452.1
2.452.1
org.jenkins-ci.main:jenkins-core
Maven
 2.217 up to 2.426.3, plus listed versions
2.2182.2192.2202.2212.222
Show 45 moreShow less
2.222.12.222.32.222.42.2232.2242.2252.2262.2272.2282.2292.2302.2312.2322.2332.2342.2352.235.12.235.22.235.32.235.42.235.52.2362.2372.2382.2392.2402.2412.2422.2432.2442.2452.2462.2472.2482.2492.249.12.249.22.249.32.2502.2512.2522.2532.2542.2552.256
2.426.3
org.jenkins-ci.main:jenkins-core
Maven
 2.427 up to 2.442, plus listed versions
2.4282.4292.4302.4312.432
Show 12 moreShow less
2.4332.4342.4352.4362.4372.4382.4392.4402.440.12.440.22.440.32.441
2.442
org.jenkins-ci.main:jenkins-core
Maven
 Listed versions
2.441
 None known
jenkins-2-plugins
Red Hat:ocp_tools:4.11::el8
From an advisory covering 11 CVEs
 before 0:4.11.1706516946-1.el8
0:4.11.1706516946-1.el8
jenkins
Red Hat:ocp_tools:4.11::el8
From an advisory covering 11 CVEs
 before 0:2.426.3.1706516929-3.el8
0:2.426.3.1706516929-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 10 CVEs
 before 0:4.13.1706516346-1.el8
0:4.13.1706516346-1.el8
jenkins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 10 CVEs
 before 0:2.426.3.1706516254-3.el8
0:2.426.3.1706516254-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 24 CVEs
 before 0:4.12.1706515741-1.el8
0:4.12.1706515741-1.el8
jenkins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 24 CVEs
 before 0:2.426.3.1706515686-3.el8
0:2.426.3.1706515686-3.el8

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubdavidmgaviria/CVE2_Jenkins_RCE2024-11-14

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-23898 is a high vulnerability (CVSS 8.8) in Jenkins, published January 24, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 67.2%, the 99th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.426.3.

References

Show 179 moreShow less
This page doesn't list everything

Left out here: 208 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open