Item Creation Bypass Vulnerability in Jenkins by CloudBees

CVE-2024-47804

Summary

A vulnerability allows attackers with the Item/Configure permission in Jenkins to bypass item creation restrictions via the Jenkins CLI or REST API. In versions 2.478 and earlier, and LTS 2.462.2 and earlier, an item attempted to be created with insufficient permissions is stored in memory instead of being properly restricted. This creates a potential security risk as attackers can save unauthorized items, compromising the integrity and security of Jenkins environments.

References