Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.jenkins-ci.main/jenkins-core@2.222.1
Typemaven
Namespaceorg.jenkins-ci.main
Namejenkins-core
Version2.222.1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.228
Latest_non_vulnerable_version2.555
Affected_by_vulnerabilities
0
url VCID-w7hn-1uj8-cuc6
vulnerability_id VCID-w7hn-1uj8-cuc6
summary 
Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-23898.json
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-23898.json
1
reference_url https://github.com/jenkinsci/jenkins
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/jenkinsci/jenkins
2
reference_url https://github.com/jenkinsci/jenkins/commit/de450967f38398169650b55c002f1229a3fcdb1b
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/jenkinsci/jenkins/commit/de450967f38398169650b55c002f1229a3fcdb1b
3
reference_url https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315
4
reference_url https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins
5
reference_url http://www.openwall.com/lists/oss-security/2024/01/24/6
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2024/01/24/6
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2260182
reference_id 2260182
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2260182
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-23898
reference_id CVE-2024-23898
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-23898
8
reference_url https://github.com/advisories/GHSA-53ph-2r2x-vqw8
reference_id GHSA-53ph-2r2x-vqw8
reference_type
scores
url https://github.com/advisories/GHSA-53ph-2r2x-vqw8
9
reference_url https://access.redhat.com/errata/RHSA-2024:0775
reference_id RHSA-2024:0775
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0775
10
reference_url https://access.redhat.com/errata/RHSA-2024:0776
reference_id RHSA-2024:0776
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0776
11
reference_url https://access.redhat.com/errata/RHSA-2024:0778
reference_id RHSA-2024:0778
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0778
fixed_packages
0
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.426.3
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.426.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.426.3
1
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.427
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.427
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-y4a2-mamb-yqg6
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.427
2
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.442
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.442
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.442
aliases CVE-2024-23898, GHSA-53ph-2r2x-vqw8
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-w7hn-1uj8-cuc6
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.222.1