{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-03T04:25:23.951","vulnerabilities":[{"cve":{"id":"CVE-2024-23905","sourceIdentifier":"jenkinsci-cert@googlegroups.com","published":"2024-01-24T18:15:09.750","lastModified":"2026-06-17T07:13:50.590","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download."},{"lang":"es","value":"El complemento Jenkins Red Hat Dependency Analytics 0.7.1 y versiones anteriores deshabilita mediante programación la protección de la política de seguridad de contenido para el contenido generado por el usuario en espacios de trabajo, artefactos archivados, etc. que Jenkins ofrece para descargar."}],"affected":[{"source":"jenkinsci-cert@googlegroups.com","affectedData":[{"vendor":"Jenkins Project","product":"Jenkins Red Hat Dependency Analytics Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"0.7.1","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-01-24T19:40:54.197023Z","id":"CVE-2024-23905","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jenkins:red_hat_dependency_analytics:*:*:*:*:*:jenkins:*:*","versionEndIncluding":"0.7.1","matchCriteriaId":"EA0AECA6-19B8-42BD-9272-33BBB12A8A18"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2024/01/24/6","source":"jenkinsci-cert@googlegroups.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3322","source":"jenkinsci-cert@googlegroups.com","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/01/24/6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3322","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}