CVE-2023-24429: Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
Summary
CVE-2023-24429: Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin. Affects org.jenkins-ci.plugins:semantic-versioning-plugin versions < 1.15. Fixed in 1.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Semantic Versioning Plugin is a Maven-based plugin that allows for semantic versioning in Jenkins. It provides functionality for parsing and manipulating version numbers in a standardized way. This plugin is widely used in Jenkins environments to manage versioning of software projects.
Vulnerability Detail
The Jenkins Semantic Versioning Plugin version 1.14 and earlier is vulnerable to an agent-to-controller security bypass. This vulnerability allows attackers who have control over agent processes to exploit the plugin's lack of restrictions on execution of controller/agent messages. By crafting a file with external entities, attackers can extract secrets from the Jenkins controller or perform server-side request forgery. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 1.15 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of the Jenkins Semantic Versioning Plugin to mitigate the risk of exploitation.
Conclusion
The Jenkins Semantic Versioning Plugin version 1.14 and earlier is vulnerable to an agent-to-controller security bypass. This critical vulnerability allows attackers to extract secrets or perform server-side request forgery. To mitigate the risk, it is crucial to upgrade to version 1.15 or later of the plugin. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:semantic-versioning-plugin →
FAQ
This vulnerability allows attackers with control over agent processes to extract secrets from the Jenkins controller or perform server-side request forgery. It can lead to unauthorized access, data breaches, and potential compromise of the Jenkins environment.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing a comprehensive analysis of your software's security posture.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is essential to promptly upgrade to the fixed version to prevent potential exploitation.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the only recommended solution to mitigate the risk.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-pcc2-w6m8-x5w4/GHSA-pcc2-w6m8-x5w4.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:semantic-versioning-plugin.
