Name: CVE-2024-23897: Improper Limitation of a Pathname to a Restricted Directory
Creator: Rapid7
Published: 2024-01-24T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2024-23897, CWE-27, CWE-22, Exploited in the Wild, CISA KEV Exploit, Metasploit Module, Used with Ransomware, CVSS 9.8, EPSS 0.99999, CISA KEV

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

CVSS Details

CVSS 3.1 Base Score: 9.8
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Freebsd	—	Upgrade jenkinsUpgrade jenkins-lts	Jan 25, 2024	Jan 24, 2024
Jenkins 2024 01 24	—	Upgrade Jenkins LTS to version 2.426.3Upgrade Jenkins to the latest versionUpgrade Jenkins to version 2.442Upgrade Jenkins LTS to the latest version	Jan 25, 2024	Jan 24, 2024

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence