Skip to content
Sign in
6.5 Medium

CVE-2024-23899 Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that…

Description

Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system.

Affected products and versions

Product Affected versions Fixed in
Jenkins Git server Plugin Versions not published

Other CVEs of Jenkins Git server Plugin

The 2 CVEs of Jenkins Git server Plugin →
CVE-2024-34146 Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git… 6.5 Medium
Track this CVE