CVE-2024-23900: 
Java vulnerability analysis and mitigation

CVE-2024-23900 affects the Jenkins Matrix Project Plugin versions up to and including 822.v01b_8c85d16d2. The vulnerability was discovered and reported by Kevin Guerroudj from CloudBees, Inc. and was disclosed on January 24, 2024 (Jenkins Advisory, OSS Security).

The vulnerability is a path traversal issue in the Matrix Project Plugin that occurs because the plugin does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).

This vulnerability allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system. However, the content of these files is not controllable by the attackers (Jenkins Advisory).

The vulnerability has been fixed in Matrix Project Plugin version 822.824.v14451b_c0fd42, which sanitizes user-defined axis names of Multi-configuration projects. Users should upgrade to this version or later to mitigate the vulnerability (Jenkins Advisory).