CVE-2024-23901: github branch — Fix

Description

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group.

Is your site exposed to CVE-2024-23901?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions
jenkins	github_branch_source	< 684.vea_fa_7c1e2fe3

References

Advisories & Patches

https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3040 https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3040

Other References

http://www.openwall.com/lists/oss-security/2024/01/24/6 http://www.openwall.com/lists/oss-security/2024/01/24/6

Frequently Asked Questions

What is CVE-2024-23901? +

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-23901? +

CVE-2024-23901 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-23901? +

CVE-2024-23901 affects products from jenkins, specifically: github_branch_source. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-23901? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-34144 9.8

A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission …

CVE-2025-47889 9.8

In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, …

CVE-2024-23897 9.8

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces …

CVE-2025-32754 9.1

In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, …

CVE-2025-32755 9.1

In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, …

CVE-2025-47884 9.1

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of …

CVE-2024-23901