CVE-2024-23897

Summary

CVE-2024-23897 is a vulnerability affecting Jenkins versions 2.441 and earlier, as well as LTS 2.426.2 and earlier. This issue arises from the Jenkins CLI command parser, which fails to disable a feature that interprets an '@' symbol followed by a file path in an argument as a file, leading unauthenticated attackers to read arbitrary files directly from the Jenkins controller file system. This poses a significant security risk, allowing potential data exposure. Jenkins users are advised to upgrade to a patched version as soon as possible to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.