Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-26me-tpwn-7udz
Summary
Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication functionality, like HTTP Basic authentication with API tokens, or session cookies. This endpoint is enabled when running on a version of Jetty for which Jenkins supports WebSockets. This is the case when using the provided native installers, packages, or the Docker containers, as well as when running Jenkins with the command java -jar jenkins.war.

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability.
Aliases
0
alias CVE-2024-23898
1
alias GHSA-53ph-2r2x-vqw8
Fixed_packages
0
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.426.3
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.426.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.426.3
1
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.427
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.427
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-26me-tpwn-7udz
1
vulnerability VCID-5781-s1ny-q7ey
2
vulnerability VCID-5jqb-k5g9-6bb4
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.427
2
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.442
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.442
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-as34-f89r-e7ck
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.442
Affected_packages
0
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.217
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.217
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-26me-tpwn-7udz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.217
1
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.222.1
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.222.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-26me-tpwn-7udz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.222.1
2
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.426.2
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.426.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-26me-tpwn-7udz
1
vulnerability VCID-5jqb-k5g9-6bb4
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.426.2
3
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.427
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.427
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-26me-tpwn-7udz
1
vulnerability VCID-5781-s1ny-q7ey
2
vulnerability VCID-5jqb-k5g9-6bb4
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.427
4
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.440
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.440
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-26me-tpwn-7udz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.440
5
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.441
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.441
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-26me-tpwn-7udz
1
vulnerability VCID-5jqb-k5g9-6bb4
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.441
6
url pkg:rpm/redhat/jenkins@2.426.3.1706515686-3?arch=el8
purl pkg:rpm/redhat/jenkins@2.426.3.1706515686-3?arch=el8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-26me-tpwn-7udz
1
vulnerability VCID-432r-ukuw-4bgt
2
vulnerability VCID-5jqb-k5g9-6bb4
3
vulnerability VCID-6925-fwf4-f7df
4
vulnerability VCID-9tg6-2h2y-abah
5
vulnerability VCID-9xw3-4a4u-hbbb
6
vulnerability VCID-as38-uuy9-5qhu
7
vulnerability VCID-fnpa-1sqy-u7hw
8
vulnerability VCID-q3k2-1x5q-buhy
9
vulnerability VCID-y3mv-vmwd-tydt
10
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins@2.426.3.1706515686-3%3Farch=el8
7
url pkg:rpm/redhat/jenkins@2.426.3.1706516254-3?arch=el8
purl pkg:rpm/redhat/jenkins@2.426.3.1706516254-3?arch=el8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-26me-tpwn-7udz
1
vulnerability VCID-5jqb-k5g9-6bb4
resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins@2.426.3.1706516254-3%3Farch=el8
8
url pkg:rpm/redhat/jenkins@2.426.3.1706516929-3?arch=el8
purl pkg:rpm/redhat/jenkins@2.426.3.1706516929-3?arch=el8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-26me-tpwn-7udz
1
vulnerability VCID-432r-ukuw-4bgt
2
vulnerability VCID-5jqb-k5g9-6bb4
3
vulnerability VCID-6925-fwf4-f7df
resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins@2.426.3.1706516929-3%3Farch=el8
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-23898.json
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-23898.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-23898
reference_id
reference_type
scores
0
value 0.36867
scoring_system epss
scoring_elements 0.97132
published_at 2026-04-04T12:55:00Z
1
value 0.36867
scoring_system epss
scoring_elements 0.97162
published_at 2026-04-21T12:55:00Z
2
value 0.36867
scoring_system epss
scoring_elements 0.97158
published_at 2026-04-18T12:55:00Z
3
value 0.36867
scoring_system epss
scoring_elements 0.97156
published_at 2026-04-16T12:55:00Z
4
value 0.36867
scoring_system epss
scoring_elements 0.97149
published_at 2026-04-13T12:55:00Z
5
value 0.36867
scoring_system epss
scoring_elements 0.97148
published_at 2026-04-12T12:55:00Z
6
value 0.36867
scoring_system epss
scoring_elements 0.97147
published_at 2026-04-11T12:55:00Z
7
value 0.36867
scoring_system epss
scoring_elements 0.97143
published_at 2026-04-09T12:55:00Z
8
value 0.36867
scoring_system epss
scoring_elements 0.97126
published_at 2026-04-02T12:55:00Z
9
value 0.36867
scoring_system epss
scoring_elements 0.97133
published_at 2026-04-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-23898
2
reference_url https://github.com/jenkinsci/jenkins
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/jenkinsci/jenkins
3
reference_url https://github.com/jenkinsci/jenkins/commit/de450967f38398169650b55c002f1229a3fcdb1b
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/jenkinsci/jenkins/commit/de450967f38398169650b55c002f1229a3fcdb1b
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-23898
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-23898
5
reference_url https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-26T05:30:39Z/
url https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315
6
reference_url https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins
7
reference_url http://www.openwall.com/lists/oss-security/2024/01/24/6
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-26T05:30:39Z/
url http://www.openwall.com/lists/oss-security/2024/01/24/6
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2260182
reference_id 2260182
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2260182
9
reference_url https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
reference_id excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-26T05:30:39Z/
url https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
10
reference_url https://github.com/advisories/GHSA-53ph-2r2x-vqw8
reference_id GHSA-53ph-2r2x-vqw8
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-53ph-2r2x-vqw8
11
reference_url https://access.redhat.com/errata/RHSA-2024:0775
reference_id RHSA-2024:0775
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0775
12
reference_url https://access.redhat.com/errata/RHSA-2024:0776
reference_id RHSA-2024:0776
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0776
13
reference_url https://access.redhat.com/errata/RHSA-2024:0778
reference_id RHSA-2024:0778
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0778
Weaknesses
0
cwe_id 346
name Origin Validation Error
description The product does not properly verify that the source of data or communication is valid.
1
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
3
cwe_id 79
name Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
description The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Exploits
Severity_range_score7.0 - 8.9
Exploitability0.5
Weighted_severity8.0
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-26me-tpwn-7udz