{"id":"CVE-2024-23900","aliases":["EUVD-2024-0334","GHSA-cjgm-9vc9-56mx","RHSA-2024:3634","RHSA-2024:3635","RHSA-2024:3636","RHSA-2024:4597"],"status":"published","title":"Path traversal vulnerability in Jenkins Matrix Project Plugin","description":"Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00691,"percentile":0.53147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-01-24T17:52:24Z","modified":"2026-10-24T10:30:43Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:matrix-project","fixed_in":["822.824.v14451b"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:matrix-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"822.824.v14451b"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:matrix-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"822.824.v14451b"}]}],"versions":["1.0","1.0-beta-1","1.1","1.10","1.11","1.12","1.13","1.14","1.14.1","1.15","1.16","1.17","1.18","1.18.1","1.19","1.2","1.2.1","1.20","1.3","1.4","1.4.1","1.5","1.6","1.7","1.7.1","1.8","1.9","751.v496d84c0d414","758.v7a_ea_491852f3","771.v574584b_39e60","772.v494f19991984","785.v06b_7f47b_c631","789.v57a_725b_63c79","802.v8013b_40c7edc","808.v5a_b_5f56d6966","818.v7eb_e657db_924","822.v01b_8c85d16d2"]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.440.3.1716387933-3.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.1716388016-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.440.3.1716445200-3.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.1716445211-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.440.3.1716445150-3.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1716445207-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.15::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.440.3.1718879390-3.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.15::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.15.1718879538-1.el8"}]}],"bundled":9}],"products":[{"vendor":"jenkins","product":"matrix_project"},{"vendor":"jenkins project","product":"jenkins matrix project plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2024/01/24/6","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23900","tags":["advisory"]},{"url":"https://github.com/jenkinsci/matrix-project-plugin/commit/f7a5b24905f69896234da34250171c1be80cddb4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cjgm-9vc9-56mx"},{"url":"https://github.com/jenkinsci/matrix-project-plugin","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3634","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260184","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268227","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278821","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3634.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-48795","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-48795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","tags":["advisory"]},{"url":"https://access.redhat.com/solutions/7071748","tags":["article"]},{"url":"https://terrapin-attack.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22201","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project/issues/11256","tags":["article"]},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23899","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23899","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3319","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23900","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24786","tags":["advisory"]},{"url":"https://go.dev/cl/569356","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28149","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3301","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34144","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34144","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/02/3","tags":["article"]},{"url":"https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34145","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3635","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3635.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3636","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3636.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4597","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258725","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4597.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21626","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2024-001","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21626","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21626","tags":["advisory"]},{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2024-23900","description":"Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.","status":"published","published":"2024-01-24T17:52:24.77Z","modified":"2025-06-16T19:32:35.214Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-0334","description":"Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.","status":"published","published":"2024-01-24T17:52:24Z","modified":"2025-06-16T19:32:35Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:23.224988Z"}],"ghsa":[{"id":"GHSA-cjgm-9vc9-56mx","title":"Path traversal vulnerability in Jenkins Matrix Project Plugin","description":"Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects submitted through the `config.xml` REST API endpoint.\n\nThis allows attackers with Item/Configure permission to create or replace any `config.xml` file on the Jenkins controller file system with content not controllable by the attackers.\n\nMatrix Project Plugin 822.824.v14451b_c0fd42 sanitizes user-defined axis names of Multi-configuration project.","status":"published","published":"2024-01-24T18:31:02Z","modified":"2024-01-31T20:23:26Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:34.405364Z"}],"nvd":[{"id":"CVE-2024-23900","description":"Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.","status":"published","published":"2024-01-24T18:15:09.523Z","modified":"2026-06-17T07:13:49.82Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:09:32.147098Z"}],"osv":[{"id":"CVE-2024-23900","description":"Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.","status":"published","published":"2024-01-24T18:15:09.523Z","modified":"2026-10-24T10:30:43.431852831Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"GHSA-cjgm-9vc9-56mx","title":"Path traversal vulnerability in Jenkins Matrix Project Plugin","description":"Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects submitted through the `config.xml` REST API endpoint.\n\nThis allows attackers with Item/Configure permission to create or replace any `config.xml` file on the Jenkins controller file system with content not controllable by the attackers.\n\nMatrix Project Plugin 822.824.v14451b_c0fd42 sanitizes user-defined axis names of Multi-configuration project.","status":"published","published":"2024-01-24T18:31:02Z","modified":"2026-08-07T08:12:06.866711149Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"RHSA-2024:3634","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update","status":"published","published":"2024-10-01T23:41:24Z","modified":"2026-10-20T10:02:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3635","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update","status":"published","published":"2024-10-01T23:41:35Z","modified":"2026-10-20T10:02:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3636","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update","status":"published","published":"2024-10-01T23:41:45Z","modified":"2026-10-20T10:02:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:4597","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update","status":"published","published":"2024-10-01T23:42:33Z","modified":"2026-10-20T10:02:54Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"}]}}