CVE-2024-52550: pipeline\ — Fix

Description

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.

Is your site exposed to CVE-2024-52550?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.0

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-354 CWE-354

Affected Products

Vendor	Product	Versions
jenkins	pipeline\	< 3975.3977.v478dd9e956c3
jenkins	pipeline\	All

References

Advisories & Patches

https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362

Frequently Asked Questions

What is CVE-2024-52550? +

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. It has a CVSS v3.1 base score of 8.0 (HIGH).

How severe is CVE-2024-52550? +

CVE-2024-52550 has a CVSS v3.1 score of 8.0 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-52550? +

CVE-2024-52550 affects products from jenkins, specifically: pipeline\. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-52550? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-54580

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream …

CVE-2026-59642

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also …

CVE-2024-48930

secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In `elliptic`-based version, `loadUncompressedPublicKey` …

CVE-2024-7402

Netskope has identified a potential gap in its agent (Netskope Client) in which a malicious insider can potentially tamper the …

CVE-2026-12816

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy …

CVE-2026-58061

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also …

CVE-2024-52550