Aller au contenu
Se connecter
9.8 Critique

CVE-2024-23897 Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Exploitation active constatée

· catalogue CISA KEV
Action attendue Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Campagnes de rançongiciel Utilisation connue
Faiblesse CWE-27

Description

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Produits et versions touchés

Produit Versions touchées Corrigé en
Jenkins 2.442 premières → < 2.442 2.442
Jenkins 2.440 premières → < 2.440.1 2.440.1
Jenkins 2.426 premières → < 2.426.3 2.426.3
jenkins 2.442 premières → < 2.442 2.442
jenkins 2.440 premières → < 2.440.1 2.440.1
jenkins 2.426 premières → < 2.426.3 2.426.3

Autres CVE de Jenkins

Les 153 CVE de Jenkins →
CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the… 4.3 Moyenne CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read… 4.3 Moyenne CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing… 8.8 Élevée CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar… 5.4 Moyenne
Suivre cette CVE