CVE-2024-23900

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

Published: Jan 24, 2024
Updated: May 4, 2025
CVE: CVE-2024-23900
GHSA: GHSA-cjgm-9vc9-56mx
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWEs:

CWE-22

OWASP TOP 10:

A5 - Broken Access Control

Affected Software
References

Software	From	Fixed in
org.jenkins-ci.plugins / matrix-project	-	822.824.v14451b
jenkins / matrix_project	-	822.v01b_8c85d16d2.x

http://www.openwall.com/lists/oss-security/2024/01/24/6
https://github.com/jenkinsci/matrix-project-plugin/commit/f7a5b24905f69896234da34250171c1be80cddb4
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289

Vulnerability Database

CVE-2024-23900

Deep Security Visibility Without the Complexity