{"id":"CVE-2024-23900","published":"2024-01-24T17:52:24Z","modified":"2025-06-16T19:32:35Z","title":"Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of…","vendor":"Jenkins","product":"Jenkins Matrix Project Plugin","tier":"tail","description":{"text":"Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00691,"percentile":0.52686,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/01/24/6","tags":[]}],"priority":{"score":13.5,"factors":[{"name":"EPSS percentile","points":10.54},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins Project","product":"Jenkins Matrix Project Plugin","versions":["<= 822.v01b_8c85d16d2"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:matrix-project","vulnerableRanges":["<822.824.v14451b"],"patched":["822.824.v14451b"],"from":["GHSA-cjgm-9vc9-56mx"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0334","exploited":false,"provenance":"source"}}