Critical severityNVD Advisory· Published Jan 24, 2023· Updated Apr 2, 2025
CVE-2023-24429
CVE-2023-24429
Description
Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:semantic-versioning-pluginMaven | < 1.15 | 1.15 |
Affected products
2- Range: unspecified
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-pcc2-w6m8-x5w4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-24429ghsaADVISORY
- github.com/jenkinsci/semantic-versioning-plugin/commit/c67a89822f86a7d10498ea2783b833052b719086ghsaWEB
- www.jenkins.io/security/advisory/2023-01-24/ghsaWEB
- www.jenkins.io/security/advisory/2023-01-24/mitre
News mentions
1- Jenkins Security Advisory 2023-01-24Jenkins Security Advisories · Jan 24, 2023