{"id":"CVE-2024-23897","aliases":["BIT-jenkins-2024-23897","EUVD-2024-0270","GHSA-6f9g-cxwr-q5jr","RHSA-2024:0775","RHSA-2024:0776","RHSA-2024:0778"],"status":"published","title":"Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE","description":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.99999,"percentile":0.99995,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-22","CWE-27"],"published":"2024-01-24T17:52:22Z","modified":"2026-10-24T10:30:20Z","kev":{"date_added":"2024-08-19","due_date":"2024-09-09","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2024-08-19"},{"source":"kev","since":"2024-08-19"}],"exploits":[{"source":"pocgithub","id":"jenkinsci-cert/SECURITY-3314-3315","title":"jenkinsci-cert/SECURITY-3314-3315","date":"2024-01-23","url":"https://github.com/jenkinsci-cert/SECURITY-3314-3315"},{"source":"pocgithub","id":"binganao/CVE-2024-23897","title":"binganao/CVE-2024-23897","date":"2024-01-26","url":"https://github.com/binganao/CVE-2024-23897"},{"source":"pocgithub","id":"h4x0r-dz/CVE-2024-23897","title":"h4x0r-dz/CVE-2024-23897","date":"2024-01-26","url":"https://github.com/h4x0r-dz/CVE-2024-23897"},{"source":"pocgithub","id":"vmtyan/poc-cve-2024-23897","title":"vmtyan/poc-cve-2024-23897","date":"2024-01-26","url":"https://github.com/vmtyan/poc-cve-2024-23897"},{"source":"pocgithub","id":"xaitax/CVE-2024-23897","title":"xaitax/CVE-2024-23897","date":"2024-01-26","url":"https://github.com/xaitax/CVE-2024-23897"},{"source":"pocgithub","id":"10T4/PoC-Fix-jenkins-rce_CVE-2024-23897","title":"10T4/PoC-Fix-jenkins-rce_CVE-2024-23897","date":"2024-01-27","url":"https://github.com/10T4/PoC-Fix-jenkins-rce_CVE-2024-23897"},{"source":"pocgithub","id":"P4x1s/CVE-2024-23897","title":"P4x1s/CVE-2024-23897","date":"2024-01-27","url":"https://github.com/P4x1s/CVE-2024-23897"},{"source":"pocgithub","id":"wjlin0/CVE-2024-23897","title":"wjlin0/CVE-2024-23897","date":"2024-01-27","url":"https://github.com/wjlin0/CVE-2024-23897"},{"source":"pocgithub","id":"yoryio/CVE-2024-23897","title":"yoryio/CVE-2024-23897","date":"2024-01-27","url":"https://github.com/yoryio/CVE-2024-23897"},{"source":"pocgithub","id":"Vozec/CVE-2024-23897","title":"Vozec/CVE-2024-23897","date":"2024-01-28","url":"https://github.com/Vozec/CVE-2024-23897"},{"source":"pocgithub","id":"r0xDB/CVE-2024-23897","title":"r0xDB/CVE-2024-23897","date":"2024-01-28","url":"https://github.com/r0xDB/CVE-2024-23897"},{"source":"pocgithub","id":"jopraveen/CVE-2024-23897","title":"jopraveen/CVE-2024-23897","date":"2024-01-29","url":"https://github.com/jopraveen/CVE-2024-23897"},{"source":"pocgithub","id":"viszsec/CVE-2024-23897","title":"viszsec/CVE-2024-23897","date":"2024-01-29","url":"https://github.com/viszsec/CVE-2024-23897"},{"source":"pocgithub","id":"AbraXa5/Jenkins-CVE-2024-23897","title":"AbraXa5/Jenkins-CVE-2024-23897","date":"2024-02-01","url":"https://github.com/AbraXa5/Jenkins-CVE-2024-23897"},{"source":"pocgithub","id":"WLXQqwer/Jenkins-CVE-2024-23897-","title":"WLXQqwer/Jenkins-CVE-2024-23897-","date":"2024-02-04","url":"https://github.com/WLXQqwer/Jenkins-CVE-2024-23897-"},{"source":"pocgithub","id":"kaanatmacaa/CVE-2024-23897","title":"kaanatmacaa/CVE-2024-23897","date":"2024-02-04","url":"https://github.com/kaanatmacaa/CVE-2024-23897"},{"source":"pocgithub","id":"GraySignal/CVE-2024-23897-Jenkins-Arbitrary-Read-File-Vulnerability","title":"GraySignal/CVE-2024-23897-Jenkins-Arbitrary-Read-File-Vulnerability","date":"2024-02-07","url":"https://github.com/GraySignal/CVE-2024-23897-Jenkins-Arbitrary-Read-File-Vulnerability"},{"source":"pocgithub","id":"B4CK4TT4CK/CVE-2024-23897","title":"B4CK4TT4CK/CVE-2024-23897","date":"2024-02-13","url":"https://github.com/B4CK4TT4CK/CVE-2024-23897"},{"source":"pocgithub","id":"godylockz/CVE-2024-23897","title":"godylockz/CVE-2024-23897","date":"2024-02-16","url":"https://github.com/godylockz/CVE-2024-23897"},{"source":"pocgithub","id":"ifconfig-me/CVE-2024-23897","title":"ifconfig-me/CVE-2024-23897","date":"2024-02-16","url":"https://github.com/ifconfig-me/CVE-2024-23897"},{"source":"pocgithub","id":"Ap0dexMe0/CVE-2024-23897","title":"Ap0dexMe0/CVE-2024-23897","date":"2024-02-19","url":"https://github.com/Ap0dexMe0/CVE-2024-23897"},{"source":"pocgithub","id":"pulentoski/CVE-2024-23897-Arbitrary-file-read","title":"pulentoski/CVE-2024-23897-Arbitrary-file-read","date":"2024-02-20","url":"https://github.com/pulentoski/CVE-2024-23897-Arbitrary-file-read"},{"source":"pocgithub","id":"Nebian/CVE-2024-23897","title":"Nebian/CVE-2024-23897","date":"2024-02-21","url":"https://github.com/Nebian/CVE-2024-23897"},{"source":"exploitdb","id":"EDB-51993","title":"Jenkins 2.441 - Local File Inclusion","type":"webapps","platform":"java","date":"2024-04-15","url":"https://www.exploit-db.com/exploits/51993"},{"source":"pocgithub","id":"JAthulya/CVE-2024-23897","title":"JAthulya/CVE-2024-23897","date":"2024-05-03","url":"https://github.com/JAthulya/CVE-2024-23897"},{"source":"pocgithub","id":"murataydemir/CVE-2024-23897","title":"murataydemir/CVE-2024-23897","date":"2024-05-07","url":"https://github.com/murataydemir/CVE-2024-23897"},{"source":"metasploit","id":"auxiliary/gather/jenkins_cli_ampersand_arbitrary_file_read","title":"Jenkins cli Ampersand Replacement Arbitrary File Read","type":"auxiliary","date":"2024-01-24","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/jenkins_cli_ampersand_arbitrary_file_read"},{"source":"nuclei","id":"CVE-2024-23897","title":"Jenkins \u003c 2.441 - Arbitrary File Read","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-23897.yaml"}],"exploits_more":25,"fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","fixed_in":["2.426.3","2.442","2.440.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"jenkins","fixed_in":["2.452.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.606"},{"last_affected":"2.426.2"},{"fixed":"2.426.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.441"},{"last_affected":"2.441"},{"fixed":"2.442"}]}],"versions":["2.441"]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.427"},{"fixed":"2.440.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jenkins","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.452.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.606"},{"fixed":"2.426.3"}]}],"versions":["1.606","1.607","1.608","1.609","1.609.1","1.609.2","1.609.3","1.610","1.611","1.612","1.613","1.614","1.615","1.616","1.617","1.618","1.619","1.620","1.621","1.622","1.623","1.624","1.625","1.625.1","1.625.2","1.625.3","1.626","1.627","1.628","1.629","1.630","1.631","1.632","1.633","1.634","1.635","1.636","1.637","1.638","1.639","1.640","1.641","1.642","1.642.1","1.642.2","1.642.3","1.642.4","1.643","1.644","1.645","1.646","1.647","1.648","1.649","1.650","1.651","1.651.1","1.651.2","1.651.3","1.652","1.653","1.654","1.655","1.656","1.657","1.658","2.0","2.0-alpha-1","2.0-alpha-2","2.0-alpha-3","2.0-alpha-4","2.0-beta-1","2.0-beta-2","2.0-rc-1","2.1","2.10","2.100","2.101","2.102","2.103","2.104","2.105","2.106","2.107","2.107.1","2.107.2","2.107.3","2.108","2.109","2.11","2.110","2.111","2.112","2.113","2.114","2.115","2.116","2.117","2.118","2.119","2.12","2.120","2.121","2.121.1","2.121.2","2.121.3","2.122","2.123","2.124","2.125","2.126","2.127","2.128","2.129","2.13","2.130","2.131","2.132","2.133","2.134","2.135","2.136","2.137","2.138","2.138.1","2.138.2","2.138.3","2.138.4","2.14","2.140","2.141","2.142","2.143","2.144","2.145","2.146","2.147","2.148","2.149","2.15","2.150","2.150.1","2.150.2","2.150.3","2.151","2.152","2.153","2.154","2.155","2.156","2.157","2.158","2.159","2.16","2.160","2.161","2.162","2.163","2.164","2.164.1","2.164.2","2.164.3","2.165","2.166","2.167","2.168","2.169","2.17","2.170","2.171","2.172","2.173","2.174","2.175","2.176","2.176.1","2.176.2","2.176.3","2.176.4","2.177","2.178","2.179","2.18","2.180","2.181","2.182","2.183","2.184","2.185","2.186","2.187","2.189","2.19","2.19.1","2.19.2","2.19.3","2.19.4","2.190","2.190.1","2.190.2","2.190.3","2.191","2.192","2.193","2.194","2.195","2.196","2.197","2.198","2.199","2.2","2.20","2.200","2.201","2.202","2.203","2.204","2.204.1","2.204.2","2.204.3","2.204.4","2.204.5","2.204.6","2.205","2.206","2.207","2.208","2.209","2.21","2.210","2.211","2.212","2.213","2.214","2.215","2.216","2.217","2.218","2.219","2.22","2.220","2.221","2.222","2.222.1","2.222.3","2.222.4","2.223","2.224","2.225","2.226","2.227","2.228","2.229","2.23","2.230","2.231","2.232","2.233","2.234","2.235","2.235.1","2.235.2","2.235.3","2.235.4","2.235.5","2.236","2.237","2.238","2.239","2.24","2.240","2.241","2.242","2.243","2.244","2.245","2.246","2.247","2.248","2.249","2.249.1","2.249.2","2.249.3","2.25","2.250","2.251","2.252","2.253","2.254","2.255","2.256","2.257","2.258","2.259","2.26","2.260","2.261","2.262","2.263","2.263.1","2.263.2","2.263.3","2.263.4","2.264","2.265","2.266","2.267","2.268","2.269","2.27","2.270","2.271","2.272","2.273","2.274","2.275","2.276","2.277","2.277.1","2.277.2","2.277.3","2.277.4","2.278","2.279","2.28","2.280","2.281","2.282","2.283","2.284","2.285","2.286","2.287","2.288","2.289","2.289.1","2.289.2","2.289.3","2.29","2.290","2.291","2.292","2.293","2.294","2.295","2.296","2.297","2.298","2.299","2.3","2.30","2.300","2.301","2.302","2.303","2.303.1","2.303.2","2.303.3","2.304","2.305","2.306","2.307","2.308","2.309","2.31","2.311","2.312","2.313","2.314","2.315","2.316","2.317","2.318","2.319","2.319.1","2.319.2","2.319.3","2.32","2.32.1","2.32.2","2.32.3","2.320","2.321","2.322","2.323","2.324","2.325","2.326","2.327","2.328","2.329","2.33","2.330","2.331","2.332","2.332.1","2.332.2","2.332.3","2.332.4","2.333","2.334","2.335","2.336","2.337","2.338","2.339","2.34","2.340","2.341","2.342","2.343","2.344","2.345","2.346","2.346.1","2.346.2","2.346.3","2.347","2.348","2.349","2.35","2.350","2.354","2.355","2.356","2.357","2.358","2.359","2.36","2.360","2.361","2.361.1","2.361.2","2.361.3","2.361.4","2.362","2.363","2.364","2.365","2.366","2.367","2.368","2.369","2.37","2.370","2.371","2.372","2.373","2.374","2.375","2.375.1","2.375.2","2.375.3","2.375.4","2.376","2.377","2.378","2.379","2.38","2.380","2.381","2.382","2.383","2.384","2.385","2.386","2.387","2.387.1","2.387.2","2.387.3","2.388","2.389","2.39","2.390","2.391","2.392","2.393","2.394","2.395","2.396","2.397","2.398","2.399","2.4","2.40","2.400","2.401","2.401.1","2.401.2","2.401.3","2.402","2.403","2.404","2.405","2.406","2.407","2.409","2.41","2.410","2.411","2.412","2.413","2.414","2.414.1","2.414.2","2.414.3","2.415","2.416","2.417","2.418","2.419","2.42","2.420","2.421","2.422","2.423","2.424","2.425","2.426","2.426.1","2.426.2","2.43","2.44","2.45","2.46","2.46.1","2.46.2","2.46.3","2.47","2.48","2.49","2.5","2.50","2.51","2.52","2.53","2.54","2.55","2.56","2.57","2.58","2.59","2.6","2.60","2.60.1","2.60.2","2.60.3","2.61","2.62","2.63","2.64","2.65","2.66","2.67","2.68","2.69","2.7","2.7.1","2.7.2","2.7.3","2.7.4","2.70","2.71","2.72","2.73","2.73.1","2.73.2","2.73.3","2.74","2.75","2.76","2.77","2.78","2.79","2.8","2.80","2.81","2.82","2.83","2.84","2.85","2.86","2.87","2.88","2.89","2.89.1","2.89.2","2.89.3","2.89.4","2.9","2.90","2.91","2.92","2.93","2.94","2.95","2.96","2.97","2.98","2.99"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.427"},{"fixed":"2.440.1"}]}],"versions":["2.427","2.428","2.429","2.430","2.431","2.432","2.433","2.434","2.435","2.436","2.437","2.438","2.439","2.440"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.441"},{"fixed":"2.442"}]}],"versions":["2.441"]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.11::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.11.1706516946-1.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.11::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.426.3.1706516929-3.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1706516346-1.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.426.3.1706516254-3.el8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.1706515741-1.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.426.3.1706515686-3.el8"}]}],"bundled":24}],"products":[{"vendor":"jenkins","product":"jenkins"},{"vendor":"jenkins","product":"jenkins command line interface (cli)"},{"vendor":"jenkins project","product":"jenkins"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/","tags":["x_transferred","Exploit","Press/Media Coverage","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2024/01/24/6","tags":["x_transferred","Mailing List","discussion","article","web"]},{"url":"http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html","tags":["x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence","web"]},{"url":"https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1","tags":["Exploit","Third Party Advisory","advisory","evidence","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23897","tags":["web","advisory"]},{"url":"https://www.jenkins.io/changelog-stable/#v2.440.1","tags":["web"]},{"url":"https://github.com/jenkinsci/jenkins/commit/554f03782057c499c49bbb06575f0d28b5200edb","tags":["web"]},{"url":"https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6f9g-cxwr-q5jr"},{"url":"https://github.com/jenkinsci/jenkins","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0775","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222709","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260182","tags":["report"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-471","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0775.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1471","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1471","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1471","tags":["advisory"]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29599","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29599","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42889","tags":["advisory"]},{"url":"https://blogs.apache.org/security/entry/cve-2022-42889","tags":["article"]},{"url":"https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om","tags":["article"]},{"url":"https://seclists.org/oss-sec/2022/q4/22","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24422","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25761","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25761","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25762","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3019","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27903","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27903","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3058","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27904","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-2120","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-37946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-37946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37946","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23897","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23897","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23898","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23898","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0776","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1955739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2126789","tags":["report"]},{"url":"https://issues.redhat.com/browse/JKNS-271","tags":["article"]},{"url":"https://issues.redhat.com/browse/JKNS-289","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-10934","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11158","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11329","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11446","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11452","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-1357","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13651","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13870","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14112","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14311","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14634","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15647","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15986","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-1709","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-1942","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-2099","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-2184","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-2318","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-27389","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-655","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-6579","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-6870","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-710","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8377","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8442","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPTOOLS-245","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0776.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-26291","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26291","tags":["advisory"]},{"url":"https://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25857","tags":["advisory"]},{"url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/525","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0778","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180530","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232425","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236341","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239634","tags":["report"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-10976","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11348","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13652","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13901","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14113","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14393","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14642","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15648","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-27391","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-3692","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-4819","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-4833","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-6632","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-6982","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-7016","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-7050","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8420","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8497","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPTOOLS-246","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0778.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1962","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1962","tags":["advisory"]},{"url":"https://go.dev/issue/53616","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-2976","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2976","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-20861","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-20861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20861","tags":["advisory"]},{"url":"https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-20862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-20862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20862","tags":["advisory"]},{"url":"https://spring.io/security/cve-2023-20862","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-26048","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26048","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-26049","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26049","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-37947","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-37947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37947","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2999","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40167","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110#section-8.6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40337","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40338","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40338","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3109","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40339","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40339","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40339","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3090","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40341","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3116","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2024-23897","description":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.","status":"published","published":"2024-01-24T17:52:22.842Z","modified":"2025-10-21T23:05:25.971Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-27"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-0270","description":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.","status":"published","published":"2024-01-24T17:52:22Z","modified":"2025-10-21T23:05:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-08-19","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-6f9g-cxwr-q5jr","title":"Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE","description":"Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment.\n\nJenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents (expandAtFiles). This feature is enabled by default and Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable it.\n\nThis allows attackers to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.\n\n* Attackers with Overall/Read permission can read entire files.\n\n* Attackers without Overall/Read permission can read the first few lines of files. The number of lines that can be read depends on available CLI commands. As of publication of this advisory, the Jenkins security team has found ways to read the first three lines of files in recent releases of Jenkins without having any plugins installed, and has not identified any plugins that would increase this line count.\n\nBinary files containing cryptographic keys used for various Jenkins features can also be read, with some limitations (see note on binary files below). As of publication, the Jenkins security team has confirmed the following possible attacks in addition to reading contents of all files with a known file path. All of them leverage attackers' ability to obtain cryptographic keys from binary files, and are therefore only applicable to instances where that is feasible.","status":"published","published":"2024-01-24T18:31:02Z","modified":"2025-10-22T19:24:55Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-22","CWE-27"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2024-23897","title":"Jenkins Command Line Interface (CLI) Path Traversal Vulnerability","description":"Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.","cwes":["CWE-27"],"kev":{"date_added":"2024-08-19","due_date":"2024-09-09","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-23897","description":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.","status":"published","published":"2024-01-24T18:15:09.37Z","modified":"2026-06-17T07:13:49.33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22","CWE-27"],"updated_at":"2026-11-02T14:09:32.147098Z"}],"osv":[{"id":"CVE-2024-23897","description":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.","status":"published","published":"2024-01-24T18:15:09.37Z","modified":"2026-10-24T10:30:20.052479909Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"GHSA-6f9g-cxwr-q5jr","title":"Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE","description":"Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment.\n\nJenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents (expandAtFiles). This feature is enabled by default and Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable it.\n\nThis allows attackers to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.\n\n* Attackers with Overall/Read permission can read entire files.\n\n* Attackers without Overall/Read permission can read the first few lines of files. The number of lines that can be read depends on available CLI commands. As of publication of this advisory, the Jenkins security team has found ways to read the first three lines of files in recent releases of Jenkins without having any plugins installed, and has not identified any plugins that would increase this line count.\n\nBinary files containing cryptographic keys used for various Jenkins features can also be read, with some limitations (see note on binary files below). As of publication, the Jenkins security team has confirmed the following possible attacks in addition to reading contents of all files with a known file path. All of them leverage attackers' ability to obtain cryptographic keys from binary files, and are therefore only applicable to instances where that is feasible.","status":"published","published":"2024-01-24T18:31:02Z","modified":"2026-08-07T08:12:22.565142377Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","level":"critical"}],"cwes":["CWE-22","CWE-27"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"RHSA-2024:0775","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T16:32:23Z","modified":"2026-10-02T10:04:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0776","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T07:10:39Z","modified":"2026-10-02T10:04:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0778","title":"Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update","status":"published","published":"2024-09-30T15:05:06Z","modified":"2026-10-13T10:06:12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"BIT-jenkins-2024-23897","description":"Jenkins LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.","status":"published","published":"2024-03-06T10:53:54.098Z","modified":"2026-09-08T08:47:57.70144023Z","updated_at":"2026-11-02T15:28:31.782692Z"}]}}