GHSA-jv82-75fh-23r7 CVE-2024-52549

Missing permission check in Jenkins Script Security Plugin

Medium Maven

Severity: 4.3 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.35%; Chance of exploitation in the next 30 days. Higher than 28.91% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-306 Missing Authentication for Critical Function; CWE-862 Missing Authorization
Fix: 1368.vb; Upgrade org.jenkins-ci.plugins:script-security to this version or later

Description

Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system. This allows attackers with Overall/Read permission to check for the existence of files on the controller file system. Script Security Plugin 1368.vb_b_402e3547e7 requires Overall/Administer permission for the affected form validation method.

Affected versions

Maven

Package	Vulnerable	Fixed in
org.jenkins-ci.plugins:script-security	`< 1368.vb`	`1368.vb`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.jenkins-ci.plugins:script-security Maven → `1368.vb`

maven

<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>script-security</artifactId><version>1368.vb</version></dependency>

gradle

implementation("org.jenkins-ci.plugins:script-security:1368.vb")

Severity breakdown

CVSS 3.1 4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Weakness

CWE-306: Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

How to prevent it

Architecture and Design: Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Architecture and Design: Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks. In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].

CWE-862: Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it

Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
System Configuration, Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2024-52549

Packages

github.com/jenkinsci/script-security-plugin

Timeline

Nov 13, 2024 Published
Aug 7, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
CVE-2019-1003029 Sandbox bypass in Script Security Plugin	Critical Known exploited	Also affects org.jenkins-ci.plugins:script-security
GHSA-cfj9-2vgr-hpxp Jenkins Script Security Plugin has a script security bypass vulnerability	High	Also affects org.jenkins-ci.plugins:script-security
GHSA-c3jm-9vj7-5v66 Jenkins Script Security Plugin sandbox bypass vulnerability	High	Also affects org.jenkins-ci.plugins:script-security
GHSA-p334-gfhq-c7w6 Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths	Medium	Also affects org.jenkins-ci.plugins:script-security
GHSA-2g4q-9vm9-9fw4 Jenkins Script Security Plugin sandbox bypass vulnerability	High	Also affects org.jenkins-ci.plugins:script-security
GHSA-v63g-v339-2673 Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies	Critical	Also affects org.jenkins-ci.plugins:script-security
GHSA-76qj-9gwh-pvv3 Sandbox bypass in Jenkins Script Security Plugin	High	Also affects org.jenkins-ci.plugins:script-security
GHSA-fv42-mx39-6fpw Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions	High	Also affects org.jenkins-ci.plugins:script-security

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor