CVE-2024-23900: Jenkins Matrix Project

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

Affected products

• Jenkins Matrix Project: up to and including 822.v01b_8c85d16d2

Published 2024-01-24. Last modified 2026-06-17.