Database/Control plane, storage & DevOps
Jenkins: Agent processes can read arbitrary controller files via ClassLoaderProxy#fetchJar
CVSS 8.8CVE-2024-43044Control plane, storage & DevOpscurated
Impact
Agent processes can read arbitrary controller files via ClassLoaderProxy#fetchJar
Who can reach it
Network (remote)
What to do
Control-plane: controller upgrade; treat build agents as untrusted
References
Related entries
- Jenkins: CLI parser expands `@file` into argument contentsCVE-2024-23897 · JenkinsCritical
- Jenkins: No origin validation on the CLI WebSocket endpointCVE-2024-23898 · JenkinsHigh
- Digi ConnectPort LTS (before 1.4.12): An attacker who can reach the ConnectPort LTS's file-upload featureCVE-2024-50627 · Digi ConnectPort LTS (before 1.4.12)High
- Deep Sea Electronics DSE855 generator communications gateway: Six unauthenticated flaws in one device: two stack-basedCVE-2024-5948 · Deep Sea Electronics DSE855 generator communications gatewayHigh
- PostgreSQL: TOCTOU race in pg_dumpCVE-2024-7348 · PostgreSQLHigh
- Automated Logic / Carrier i-Vu Gen5 BACnet router (drv_gen5_106-01-2380) and i-Vu Zone Controller: Malformed BACnetCVE-2025-0657 · Automated Logic / Carrier i-Vu Gen5 BACnet router (drv_gen5_106-01-2380) and i-Vu Zone ControllerHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.