CVE-2024-52552

Summary

CVE-2024-52552 is a stored cross-site scripting (XSS) vulnerability affecting the Jenkins Authorize Project Plugin version 1.7.2 and earlier. Attackers with Item/Configure permissions can exploit this vulnerability by injecting malicious JavaScript code into the job name string. The plugin evaluates this string on the Authorization view, allowing the attacker to execute their code in the context of other users, potentially leading to unauthorized access or data theft. This vulnerability highlights the importance of keeping plugins updated to their latest versions to mitigate such risks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.