9.8 Critique Exploitée · rançongiciel

CVE-2024-23897 Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Exploitation active constatée

· catalogue CISA KEV

Action attendue Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Campagnes de rançongiciel Utilisation connue

Faiblesse CWE-27

Description

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Jenkins 2.442	premières → < 2.442	2.442
Jenkins 2.440	premières → < 2.440.1	2.440.1
Jenkins 2.426	premières → < 2.426.3	2.426.3
jenkins 2.442	premières → < 2.442	2.442
jenkins 2.440	premières → < 2.440.1	2.440.1
jenkins 2.426	premières → < 2.426.3	2.426.3

Références

Jenkins Security Advisory 2024-01-24 www.jenkins.io
www.sonarsource.com www.sonarsource.com
www.openwall.com www.openwall.com
packetstormsecurity.com packetstormsecurity.com
packetstormsecurity.com packetstormsecurity.com

Chronologie

Publiée 24 janvier 2024
Ajoutée au catalogue KEV 19 août 2024
Dernière modification 21 octobre 2025

Les 153 CVE de Jenkins →

CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the… 4.3 Moyenne CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read… 4.3 Moyenne CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing… 8.8 Élevée CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar… 5.4 Moyenne

Suivre cette CVE