description: Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
affected:
{
defaultStatus: affected
product: Jenkins
vendor: Jenkins Project
versions:
lessThan: 2.217, status: unaffected, version: 0, versionType: maven
lessThan: *, status: unaffected, version: 2.442, versionType: maven
lessThan: 2.426.*, status: unaffected, version: 2.426.3, versionType: maven
lessThan: 2.440.*, status: unaffected, version: 2.440.1, versionType: maven
}