Moderate severityNVD Advisory· Published Jan 24, 2024· Updated Jun 16, 2025
CVE-2024-23900
CVE-2024-23900
Description
Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:matrix-projectMaven | < 822.824.v14451b | 822.824.v14451b |
Affected products
8- osv-coords7 versionspkg:apk/chainguard/jenkinspkg:apk/chainguard/jenkins-compatpkg:apk/chainguard/jenkins-remotingpkg:apk/wolfi/jenkinspkg:apk/wolfi/jenkins-compatpkg:apk/wolfi/jenkins-remotingpkg:maven/org.jenkins-ci.plugins/matrix-project
< 2.443-r0+ 6 more
- (no CPE)range: < 2.443-r0
- (no CPE)range: < 2.443-r0
- (no CPE)range: < 2.443-r0
- (no CPE)range: < 2.443-r0
- (no CPE)range: < 2.443-r0
- (no CPE)range: < 2.443-r0
- (no CPE)range: < 822.824.v14451b
- Range: 0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-cjgm-9vc9-56mxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-23900ghsaADVISORY
- www.jenkins.io/security/advisory/2024-01-24/ghsavendor-advisoryWEB
- www.openwall.com/lists/oss-security/2024/01/24/6ghsaWEB
- github.com/jenkinsci/matrix-project-plugin/commit/f7a5b24905f69896234da34250171c1be80cddb4ghsaWEB
News mentions
1- Jenkins Security Advisory 2024-01-24Jenkins Security Advisories · Jan 24, 2024