CVE-2024-23897

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-27

Affected software

Vendor	Product	Versions
Jenkins Project	Jenkins	—
jenkins	jenkins	—
jenkins	jenkins	—
jenkins	jenkins	—
jenkins	jenkins	—

References

http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.htmlExploit, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2024/01/24/6Mailing List
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314Vendor Advisory
https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/Exploit, Press/Media Coverage
http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.htmlExploit, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2024/01/24/6Mailing List
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314Vendor Advisory
https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/Exploit, Press/Media Coverage
https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897US Government Resource

Timeline

Published: Jan 24, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Aug 19, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-238988.8Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests ma CVE-2024-238996.5Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character f CVE-2024-23907.8As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability CVE-2024-239004.3Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allo CVE-2024-239016.5Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured o CVE-2024-239024.3A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to CVE-2024-239035.3Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the p CVE-2024-239047.5Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a f CVE-2024-239055.4Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generate CVE-2024-239066.1Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnostic webpage allows an CVE-2024-239077.8Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software before version 23.4 may allow an authenticated user to pote CVE-2024-239087.8Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may allow an authenticate