CVE-2024-43045

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.470 and earlier Jenkins LTS versions 2.452.3 and earlier

Description The issue arises from a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views". Additionally, attackers with global View/Configure and View/Delete permissions can modify other users' "My Views".

Recommendations For Jenkins versions 2.470 and earlier, update to version 2.471 or later to restrict access to a user’s "My Views" to the owning user and administrators. For Jenkins LTS versions 2.452.3 and earlier, update to version 2.452.4 or later, or version 2.462.1 or later, to restrict access to a user’s "My Views" to the owning user and administrators.