Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the
    Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
    (CVE-2024-43044)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5406 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE (CVE-2024-43044)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5411 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jenkins: Arbitrary file read vulnerability through agent connections can lead     to RCE (CVE-2024-43044)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5410 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE (CVE-2024-43044)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5405 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE (CVE-2024-43044)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the db8fa362-0ccb-4aa8-9220-72b7763e9a4a advisory.

    Jenkins Security Advisory:
    Arbitrary file read vulnerability through agent connections can lead to RCE     Missing permission check allows accessing other users' My Views

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.452.4 or Jenkins weekly prior to 2.471. It is, therefore, affected by multiple vulnerabilities:

  - Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the     Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
    (CVE-2024-43044)

  - Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP     endpoint, allowing attackers with Overall/Read permission to access other users' My Views.
    (CVE-2024-43045)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
415583	SCA: security update for org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:remoting (GHSA-h856-ffvv-xvr4)	Tenable Cloud Security	SCA Checks	high
415583	SCA: security update for org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:remoting (GHSA-h856-ffvv-xvr4)	Tenable Self-Hosted Container Security	SCA Checks	high
205554	RHEL 8 : Red Hat Product OCP Tools 4.13 OpenShift Jenkins (RHSA-2024:5406)	Nessus	Red Hat Local Security Checks	high
205553	RHEL 8 : Red Hat Product OCP Tools 4.14 OpenShift Jenkins (RHSA-2024:5411)	Nessus	Red Hat Local Security Checks	high
205552	RHEL 8 : Red Hat Product OCP Tools 4.12 OpenShift Jenkins (RHSA-2024:5410)	Nessus	Red Hat Local Security Checks	high
205551	RHEL 8 : Red Hat Product OCP Tools 4.15 OpenShift Jenkins (RHSA-2024:5405)	Nessus	Red Hat Local Security Checks	high
205217	FreeBSD : jenkins -- multiple vulnerabilities (db8fa362-0ccb-4aa8-9220-72b7763e9a4a)	Nessus	FreeBSD Local Security Checks	high
205143	Jenkins LTS < 2.452.4 / Jenkins weekly < 2.471 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2024-43044

high

Tenable Plugins

high

high

high

high

high

high

high

high