CVE-2024-47804

Summary

CVE-2024-47804 is a vulnerability affecting Jenkins versions 2.478 and earlier, as well as LTS 2.462.2 and earlier. If an attacker attempts to create a prohibited item type using the Jenkins CLI or REST API, and the checks `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` fail, Jenkins will create the item in memory, but not delete it from disk. This allows attackers with Item/Configure permissions to save the item, thereby bypassing the item creation restriction and potentially causing unintended changes or data leakage.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.