CVE-2024-23900: matrix project — Fix

Description

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

Is your site exposed to CVE-2024-23900?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected Products

Vendor	Product	Versions
jenkins	matrix_project	< 822.v01b_8c85d16d2

References

Advisories & Patches

https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289 https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289

Other References

http://www.openwall.com/lists/oss-security/2024/01/24/6 http://www.openwall.com/lists/oss-security/2024/01/24/6

Frequently Asked Questions

What is CVE-2024-23900? +

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers. It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2024-23900? +

CVE-2024-23900 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-23900? +

CVE-2024-23900 affects products from jenkins, specifically: matrix_project. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-23900? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-34144 9.8

A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission …

CVE-2025-47889 9.8

In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, …

CVE-2024-23897 9.8

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces …

CVE-2025-32754 9.1

In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, …

CVE-2025-32755 9.1

In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, …

CVE-2025-47884 9.1

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of …

CVE-2024-23900