{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-04T16:49:18.567","vulnerabilities":[{"cve":{"id":"CVE-2024-47804","sourceIdentifier":"jenkinsci-cert@googlegroups.com","published":"2024-10-02T16:15:10.697","lastModified":"2026-06-17T07:57:46.907","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction."},{"lang":"es","value":"Si se intenta crear un elemento de un tipo prohibido por `ACL#hasCreatePermission2` o `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` a través de la CLI de Jenkins o la API REST y cualquiera de estas comprobaciones falla, Jenkins 2.478 y anteriores, LTS 2.462.2 y anteriores crean el elemento en la memoria, solo eliminándolo del disco, lo que permite a los atacantes con permiso de Elemento/Configurar guardar el elemento para persistirlo, eludiendo efectivamente la restricción de creación de elementos."}],"affected":[{"source":"jenkinsci-cert@googlegroups.com","affectedData":[{"vendor":"Jenkins Project","product":"Jenkins","defaultStatus":"affected","versions":[{"version":"2.462.3","lessThan":"2.462.*","versionType":"maven","status":"unaffected"},{"version":"2.479","lessThan":"*","versionType":"maven","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-02T16:31:07.297191Z","id":"CVE-2024-47804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*","versionEndExcluding":"2.462.3","matchCriteriaId":"3DA7AA45-38D7-4467-99C6-A34C63603CF9"},{"vulnerable":true,"criteria":"cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*","versionEndExcluding":"2.479","matchCriteriaId":"F3B756C9-D72A-42D2-8E00-C4DF866AA11A"}]}]}],"references":[{"url":"https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3448","source":"jenkinsci-cert@googlegroups.com","tags":["Vendor Advisory"]}]}}]}