FKIE_CVE-2024-23897

Vulnerability from fkie_nvd - Published: 2024-01-24 18:15 - Updated: 2026-06-17 07:13
Severity
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
References
jenkinsci-cert@googlegroups.comhttp://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.htmlThird Party Advisory, VDB Entry
jenkinsci-cert@googlegroups.comhttp://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.htmlExploit, Third Party Advisory, VDB Entry
jenkinsci-cert@googlegroups.comhttp://www.openwall.com/lists/oss-security/2024/01/24/6Mailing List
jenkinsci-cert@googlegroups.comhttps://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314Vendor Advisory
jenkinsci-cert@googlegroups.comhttps://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/Exploit, Press/Media Coverage
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.htmlThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.htmlExploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/01/24/6Mailing List
af854a3a-2127-422b-91ae-364da2661108https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/Exploit, Press/Media Coverage
af854a3a-2127-422b-91ae-364da2661108https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897US Government Resource
Impacted products
Vendor Product Version
jenkins jenkins *
jenkins jenkins *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "1.606",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.442",
              "versionType": "maven"
            },
            {
              "lessThan": "2.426.*",
              "status": "unaffected",
              "version": "2.426.3",
              "versionType": "maven"
            },
            {
              "lessThan": "2.440.*",
              "status": "unaffected",
              "version": "2.440.1",
              "versionType": "maven"
            }
          ]
        }
      ],
      "source": "jenkinsci-cert@googlegroups.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "product": "jenkins",
          "vendor": "jenkins",
          "versions": [
            {
              "lessThan": "1.606",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.442",
              "versionType": "maven"
            },
            {
              "lessThan": "2.427",
              "status": "unaffected",
              "version": "2.426.3",
              "versionType": "maven"
            },
            {
              "lessThan": "2.441",
              "status": "unaffected",
              "version": "2.440.1",
              "versionType": "maven"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "product": "jenkins",
          "vendor": "jenkins",
          "versions": [
            {
              "lessThan": "1.606",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.442",
              "versionType": "maven"
            },
            {
              "lessThan": "2.427",
              "status": "unaffected",
              "version": "2.426.3",
              "versionType": "maven"
            },
            {
              "lessThan": "2.441",
              "status": "unaffected",
              "version": "2.440.1",
              "versionType": "maven"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "product": "jenkins",
          "vendor": "jenkins",
          "versions": [
            {
              "lessThan": "1.606",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.442",
              "versionType": "maven"
            },
            {
              "lessThan": "2.427",
              "status": "unaffected",
              "version": "2.426.3",
              "versionType": "maven"
            },
            {
              "lessThan": "2.441",
              "status": "unaffected",
              "version": "2.440.1",
              "versionType": "maven"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "product": "jenkins",
          "vendor": "jenkins",
          "versions": [
            {
              "lessThan": "1.606",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.442",
              "versionType": "maven"
            },
            {
              "lessThan": "2.427",
              "status": "unaffected",
              "version": "2.426.3",
              "versionType": "maven"
            },
            {
              "lessThan": "2.441",
              "status": "unaffected",
              "version": "2.440.1",
              "versionType": "maven"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cisaActionDue": "2024-09-09",
  "cisaExploitAdd": "2024-08-19",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Jenkins Command Line Interface (CLI) Path Traversal Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*",
              "matchCriteriaId": "669379F5-5F67-4002-AD76-F8C470C89D61",
              "versionEndExcluding": "2.426.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "493B263C-C8C7-4741-B7F8-B672E86CC8B4",
              "versionEndExcluding": "2.442",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an \u0027@\u0027 character followed by a file path in an argument with the file\u0027s contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system."
    },
    {
      "lang": "es",
      "value": "Jenkins 2.441 y anteriores, LTS 2.426.2 y anteriores no desactivan una funci\u00f3n de su analizador de comandos CLI que reemplaza un car\u00e1cter \u0027@\u0027 seguido de una ruta de archivo en un argumento con el contenido del archivo, lo que permite a atacantes no autenticados leer archivos arbitrarios en el sistema de archivos del controlador Jenkins."
    }
  ],
  "id": "CVE-2024-23897",
  "lastModified": "2026-06-17T07:13:49.330",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-23897",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-08-19T15:35:31.038735Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-01-24T18:15:09.370",
  "references": [
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html"
    },
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html"
    },
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "tags": [
        "Mailing List"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2024/01/24/6"
    },
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314"
    },
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "tags": [
        "Exploit",
        "Press/Media Coverage"
      ],
      "url": "https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2024/01/24/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Press/Media Coverage"
      ],
      "url": "https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897"
    }
  ],
  "sourceIdentifier": "jenkinsci-cert@googlegroups.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-27"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.