CVE-2024-52549: 
Java vulnerability analysis and mitigation

Jenkins Script Security Plugin version 1367.vdf2fc45f229c and earlier (except versions 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776) contains a security vulnerability identified as CVE-2024-52549. The vulnerability was disclosed on November 13, 2024, and affects the permission checking mechanism in the plugin's form validation method (Jenkins Advisory).

The vulnerability stems from a missing permission check in a method implementing form validation within the Script Security Plugin. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) (CISA-ADP).

This vulnerability allows attackers with Overall/Read permission to check for the existence of files on the controller file system, potentially exposing sensitive information about the file system structure (Jenkins Advisory).

The vulnerability has been fixed in Script Security Plugin version 1368.vb_b_402e3547e7, which now requires Overall/Administer permission for the affected form validation method. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).