{
  "document" : {
    "aggregate_severity" : {
      "text" : "hoch"
    },
    "category" : "csaf_base",
    "csaf_version" : "2.0",
    "distribution" : {
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "de-DE",
    "notes" : [ {
      "category" : "legal_disclaimer",
      "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."
    }, {
      "category" : "description",
      "text" : "Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.",
      "title" : "Produktbeschreibung"
    }, {
      "category" : "summary",
      "text" : "Ein entfernter authentisierter Angreifer oder ein anonymer Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Dateien zu manipulieren, vertrauliche Informationen preiszugeben, beliebigen Code auszuführen, sich erhöhte Rechte zu verschaffen und einen Cross-Site-Scripting-Angriff durchzuführen.",
      "title" : "Angriff"
    }, {
      "category" : "general",
      "text" : "- Sonstiges\n- UNIX\n- Windows",
      "title" : "Betroffene Betriebssysteme"
    } ],
    "publisher" : {
      "category" : "other",
      "contact_details" : "csaf-provider@cert-bund.de",
      "name" : "Bundesamt für Sicherheit in der Informationstechnik",
      "namespace" : "https://www.bsi.bund.de"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "WID-SEC-W-2024-3456 - CSAF Version",
      "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3456.json"
    }, {
      "category" : "self",
      "summary" : "WID-SEC-2024-3456 - Portal Version",
      "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3456"
    }, {
      "category" : "external",
      "summary" : "Jenkins Security Advisory vom 2024-11-13",
      "url" : "https://www.jenkins.io/security/advisory/2024-11-13/"
    }, {
      "category" : "external",
      "summary" : "Red Hat Security Advisory RHSA-2025:2222 vom 2025-03-04",
      "url" : "https://access.redhat.com/errata/RHSA-2025:2222"
    }, {
      "category" : "external",
      "summary" : "Red Hat Security Advisory RHSA-2025:2218 vom 2025-03-04",
      "url" : "https://access.redhat.com/errata/RHSA-2025:2218"
    }, {
      "category" : "external",
      "summary" : "Red Hat Security Advisory RHSA-2025:2219 vom 2025-03-04",
      "url" : "https://access.redhat.com/errata/RHSA-2025:2219"
    }, {
      "category" : "external",
      "summary" : "Red Hat Security Advisory RHSA-2025:2220 vom 2025-03-04",
      "url" : "https://access.redhat.com/errata/RHSA-2025:2220"
    }, {
      "category" : "external",
      "summary" : "Red Hat Security Advisory RHSA-2025:2221 vom 2025-03-04",
      "url" : "https://access.redhat.com/errata/RHSA-2025:2221"
    }, {
      "category" : "external",
      "summary" : "Red Hat Security Advisory RHSA-2025:2223 vom 2025-03-04",
      "url" : "https://access.redhat.com/errata/RHSA-2025:2223"
    } ],
    "source_lang" : "en-US",
    "title" : "Jenkins Plugins: Mehrere Schwachstellen",
    "tracking" : {
      "current_release_date" : "2025-03-04T23:00:00.000+00:00",
      "generator" : {
        "date" : "2026-07-16T17:12:36.860+00:00",
        "engine" : {
          "name" : "BSI-WID",
          "version" : "1.6.0"
        }
      },
      "id" : "WID-SEC-W-2024-3456",
      "initial_release_date" : "2024-11-13T23:00:00.000+00:00",
      "revision_history" : [ {
        "date" : "2024-11-13T23:00:00.000+00:00",
        "number" : "1",
        "summary" : "Initiale Fassung"
      }, {
        "date" : "2025-03-04T23:00:00.000+00:00",
        "number" : "2",
        "summary" : "Neue Updates von Red Hat aufgenommen"
      } ],
      "status" : "final",
      "version" : "2"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "Authorize Project Plugin <1.8.0",
          "product" : {
            "name" : "Jenkins Jenkins Authorize Project Plugin <1.8.0",
            "product_id" : "T039140"
          }
        }, {
          "category" : "product_version",
          "name" : "Authorize Project Plugin 1.8.0",
          "product" : {
            "name" : "Jenkins Jenkins Authorize Project Plugin 1.8.0",
            "product_id" : "T039140-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:cloudbees:jenkins:authorize_project_plugin__1.8.0"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "IvyTrigger Plugin <1.02",
          "product" : {
            "name" : "Jenkins Jenkins IvyTrigger Plugin <1.02",
            "product_id" : "T039141"
          }
        }, {
          "category" : "product_version",
          "name" : "IvyTrigger Plugin 1.02",
          "product" : {
            "name" : "Jenkins Jenkins IvyTrigger Plugin 1.02",
            "product_id" : "T039141-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:cloudbees:jenkins:ivytrigger_plugin__1.02"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "OpenId Connect Authentication Plugin <.421.v5422614eb_e0a_",
          "product" : {
            "name" : "Jenkins Jenkins OpenId Connect Authentication Plugin <.421.v5422614eb_e0a_",
            "product_id" : "T039142"
          }
        }, {
          "category" : "product_version",
          "name" : "OpenId Connect Authentication Plugin .421.v5422614eb_e0a_",
          "product" : {
            "name" : "Jenkins Jenkins OpenId Connect Authentication Plugin .421.v5422614eb_e0a_",
            "product_id" : "T039142-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:cloudbees:jenkins:openid_connect_authentication_plugin__.421.v5422614eb_e0a_"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "Pipeline Declarative Plugin <2.2218.v56d0cda_37c72",
          "product" : {
            "name" : "Jenkins Jenkins Pipeline Declarative Plugin <2.2218.v56d0cda_37c72",
            "product_id" : "T039143"
          }
        }, {
          "category" : "product_version",
          "name" : "Pipeline Declarative Plugin 2.2218.v56d0cda_37c72",
          "product" : {
            "name" : "Jenkins Jenkins Pipeline Declarative Plugin 2.2218.v56d0cda_37c72",
            "product_id" : "T039143-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:cloudbees:jenkins:pipeline_declarative_plugin__2.2218.v56d0cda_37c72"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "Pipeline Groovy Plugin <3993.v3e20a_37282f8",
          "product" : {
            "name" : "Jenkins Jenkins Pipeline Groovy Plugin <3993.v3e20a_37282f8",
            "product_id" : "T039144"
          }
        }, {
          "category" : "product_version",
          "name" : "Pipeline Groovy Plugin 3993.v3e20a_37282f8",
          "product" : {
            "name" : "Jenkins Jenkins Pipeline Groovy Plugin 3993.v3e20a_37282f8",
            "product_id" : "T039144-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:cloudbees:jenkins:pipeline_groovy_plugin__3993.v3e20a_37282f8"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "Shared Library Version Override Plugin <19.v3a_c975738d4a_",
          "product" : {
            "name" : "Jenkins Jenkins Shared Library Version Override Plugin <19.v3a_c975738d4a_",
            "product_id" : "T039146"
          }
        }, {
          "category" : "product_version",
          "name" : "Shared Library Version Override Plugin 19.v3a_c975738d4a_",
          "product" : {
            "name" : "Jenkins Jenkins Shared Library Version Override Plugin 19.v3a_c975738d4a_",
            "product_id" : "T039146-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:cloudbees:jenkins:shared_library_version_override_plugin__19.v3a_c975738d4a_"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "Script Security Plugin <1368.vb_b_402e3547e7",
          "product" : {
            "name" : "Jenkins Jenkins Script Security Plugin <1368.vb_b_402e3547e7",
            "product_id" : "T039147"
          }
        }, {
          "category" : "product_version",
          "name" : "Script Security Plugin 1368.vb_b_402e3547e7",
          "product" : {
            "name" : "Jenkins Jenkins Script Security Plugin 1368.vb_b_402e3547e7",
            "product_id" : "T039147-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:cloudbees:jenkins:script_security_plugin__1368.vb_b_402e3547e7"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "Jenkins"
      } ],
      "category" : "vendor",
      "name" : "Jenkins"
    }, {
      "branches" : [ {
        "category" : "product_name",
        "name" : "Red Hat Enterprise Linux",
        "product" : {
          "name" : "Red Hat Enterprise Linux",
          "product_id" : "67646",
          "product_identification_helper" : {
            "cpe" : "cpe:/o:redhat:enterprise_linux:-"
          }
        }
      } ],
      "category" : "vendor",
      "name" : "Red Hat"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2022-46751",
    "product_status" : {
      "known_affected" : [ "T039141", "67646" ]
    },
    "release_date" : "2024-11-13T23:00:00.000+00:00",
    "title" : "CVE-2022-46751"
  }, {
    "cve" : "CVE-2024-52549",
    "product_status" : {
      "known_affected" : [ "67646", "T039147" ]
    },
    "release_date" : "2024-11-13T23:00:00.000+00:00",
    "title" : "CVE-2024-52549"
  }, {
    "cve" : "CVE-2024-52550",
    "product_status" : {
      "known_affected" : [ "T039144", "T039143", "67646" ]
    },
    "release_date" : "2024-11-13T23:00:00.000+00:00",
    "title" : "CVE-2024-52550"
  }, {
    "cve" : "CVE-2024-52551",
    "product_status" : {
      "known_affected" : [ "T039144", "T039143", "67646" ]
    },
    "release_date" : "2024-11-13T23:00:00.000+00:00",
    "title" : "CVE-2024-52551"
  }, {
    "cve" : "CVE-2024-52552",
    "product_status" : {
      "known_affected" : [ "67646", "T039140" ]
    },
    "release_date" : "2024-11-13T23:00:00.000+00:00",
    "title" : "CVE-2024-52552"
  }, {
    "cve" : "CVE-2024-52553",
    "product_status" : {
      "known_affected" : [ "T039142", "67646" ]
    },
    "release_date" : "2024-11-13T23:00:00.000+00:00",
    "title" : "CVE-2024-52553"
  }, {
    "cve" : "CVE-2024-52554",
    "product_status" : {
      "known_affected" : [ "67646", "T039146" ]
    },
    "release_date" : "2024-11-13T23:00:00.000+00:00",
    "title" : "CVE-2024-52554"
  } ]
}