CVE-2024-43045: Medium severity jenkins lts vulnerability
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".
Other sources
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to access other users' "My Views". Attackers with global View/Configure and View/Delete permissions are also able to change other users' "My Views".
Jenkins 2.471, LTS 2.452.4, LTS 2.462.1 restricts access to a user’s "My Views" to the owning user and administrators.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43045?
CVE-2024-43045 has a high severity level due to unauthorized access to user data.
How do I fix CVE-2024-43045?
To fix CVE-2024-43045, upgrade to Jenkins version 2.471 or later, or LTS version 2.462.1 or later.
Which Jenkins versions are affected by CVE-2024-43045?
Jenkins versions 2.470 and earlier, and LTS versions 2.452.3 and earlier are affected by CVE-2024-43045.
What types of permissions allow exploitation of CVE-2024-43045?
Users with Overall/Read permission can exploit CVE-2024-43045 to access other users' My Views.
Is CVE-2024-43045 related to user permissions?
Yes, CVE-2024-43045 is specifically related to the lack of permission checks in an HTTP endpoint for user views.