(CVE-2024-43044) Jenkins Remoting 库 ClassLoaderProxy#fetchJar 方法文件读取漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-43044
• https://www.jenkins.io/security/advisory/2024-08-07/
• https://www.cve.org/CVERecord?id=CVE-2024-43044
• https://blog.convisoappsec.com/en/analysis-of-cve-2024-43044/
• https://github.com/convisolabs/CVE-2024-43044-jenkins
• https://github.com/HwMex0/CVE-2024-43044
• https://access.redhat.com/security/cve/cve-2024-43044
• https://github.com/advisories/GHSA-h856-ffvv-xvr4
• https://www.upwind.io/feed/jenkins-agents-remote-code-execution-vulnerability-cve-2024-43044
• https://security.snyk.io/vuln/SNYK-JAVA-ORGJENKINSCIMAIN-7647211

Related Vulnerabilities

• Jenkins 代码执行漏洞（CVE-2026-84645）
• PoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization
• Jenkins /view 文件读取漏洞（CVE-2026-53435）
• （CVE-2025-59474）Jenkins侧边栏权限绕过漏洞
• jenkins-unauthorized-rce: Jenkins unauthorized rce
• PoCCVE-2017-1000353: Jenkins CLI - Java Deserialization
• PoCCVE-2016-9299: Jenkins CLI - HTTP Java Deserialization
• PoCCVE-2018-1000600: Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery
• PoCCVE-2018-1000861: Jenkins - Remote Command Injection
• PoCCVE-2019-1003000: Jenkins Script Security Plugin <=1.49 - Sandbox Bypass
• PoCCVE-2019-10405: Jenkins <=2.196 - Cookie Exposure
• PoCCVE-2019-10475: Jenkins build-metrics 1.3 - Cross-Site Scripting
• PoCCVE-2020-2096: Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting