CVE-2024-43045: Jenkins Auth Bypass Vulnerability

CVE-2024-43045 Overview

CVE-2024-43045 is a missing authorization vulnerability in Jenkins, the widely deployed open-source automation server. Jenkins 2.470 and earlier, and LTS 2.452.3 and earlier, fail to perform a permission check on an HTTP endpoint that exposes user-specific "My Views". Attackers with Overall/Read permission can access other users' "My Views" configurations. The flaw is tracked as CWE-862: Missing Authorization and was disclosed in the Jenkins Security Advisory 2024-08-07 under identifier SECURITY-3349.

Critical Impact
Authenticated users with minimal read permissions can enumerate and view other users' private "My Views" content in Jenkins, leading to unauthorized information disclosure across the automation server.

Affected Products

Jenkins weekly releases 2.470 and earlier
Jenkins LTS 2.452.3 and earlier
Jenkins instances exposing the Overall/Read permission to non-administrative users

Discovery Timeline

2024-08-07 - Jenkins publishes Security Advisory SECURITY-3349 with patched releases
2024-08-07 - CVE-2024-43045 published to NVD
2025-03-25 - Last updated in NVD database

Technical Details for CVE-2024-43045

Vulnerability Analysis

The vulnerability resides in an HTTP endpoint that serves "My Views", a Jenkins feature allowing each user to maintain a personal set of dashboard views. The endpoint does not validate whether the requesting user owns the views being accessed. Any authenticated user holding Overall/Read permission can request another user's "My Views" by supplying the target username in the request path.

The issue is a classic broken access control flaw. The endpoint authenticates the caller but never authorizes the action against the target resource. Because "My Views" can contain job listings, filters, and view configurations referencing internal pipelines, the exposure leaks information about the build environment, project naming conventions, and job structure visible to specific users.

Exploitation requires only a valid Jenkins account with read access. No user interaction is required, and the attack is performed entirely over the network through standard HTTP requests to the Jenkins web interface.

Root Cause

The root cause is a missing permission check in the HTTP handler that resolves the /user/<username>/my-views/ route. The handler retrieves the target user's view configuration without verifying that the authenticated principal matches the target user or holds administrative privileges. Jenkins typically enforces such checks through checkPermission calls or @RequirePOST and ownership validation logic, which were absent in the affected endpoint.

Attack Vector

An authenticated attacker sends an HTTP GET request to the Jenkins endpoint that renders another user's "My Views" page. The request follows the pattern /user/<target-username>/my-views/view/<view-name>/. The server returns the requested view content without performing an ownership or permission check. The attacker can iterate through known usernames to harvest view data across the instance.

The vulnerability is described in the Jenkins Security Advisory 2024-08-07 SECURITY-3349. No public proof-of-concept exploit code is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-43045

Indicators of Compromise

HTTP GET requests to /user/<username>/my-views/ paths where the authenticated user does not match <username>
Sequential or scripted access patterns enumerating multiple /user/*/my-views/ URLs from a single session
Access log entries showing low-privilege accounts retrieving view data belonging to administrators or service accounts

Detection Strategies

Parse Jenkins access logs and correlate the authenticated session identity with the <username> path segment in /user/*/my-views/ requests. Flag mismatches.
Alert on accounts holding only Overall/Read permission that issue requests against multiple distinct /user/*/ paths within a short window.
Monitor for HTTP 200 responses to /user/<username>/my-views/view/* URLs originating from accounts other than the named user.

Monitoring Recommendations

Forward Jenkins access logs and audit logs to a centralized logging platform for retention and query.
Baseline normal usage of /user/*/ endpoints and review deviations weekly.
Track Jenkins version inventory across the environment to confirm patched builds are deployed.

How to Mitigate CVE-2024-43045

Immediate Actions Required

Upgrade Jenkins weekly to version 2.471 or later.
Upgrade Jenkins LTS to version 2.452.4 or later.
Audit assigned Overall/Read permissions and remove access for accounts that do not require it.
Review Jenkins audit logs for unauthorized access to other users' my-views endpoints prior to patching.

Patch Information

Jenkins resolved CVE-2024-43045 by adding the missing permission check to the affected HTTP endpoint. The fix is included in Jenkins weekly 2.471 and Jenkins LTS 2.452.4. Refer to the Jenkins Security Advisory 2024-08-07 for full remediation guidance and release notes.

Workarounds

Restrict the Overall/Read permission to trusted authenticated users only, using Jenkins' authorization strategy configuration.
Place Jenkins behind an authenticating reverse proxy that limits access to known administrators until patches are applied.
Disable anonymous and signup-based account creation to reduce the pool of accounts that could exploit the endpoint.

bash

# Verify the running Jenkins version against patched releases
curl -s -u <admin>:<token> https://<jenkins-host>/api/json | \
  jq -r '.version // "unknown"'

# Expected patched versions:
#   Weekly: 2.471 or later
#   LTS:    2.452.4 or later