Jenkins · Jenkins Command Line Interface (CLI)
CVE-2024-23897
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
What it is
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
CISA: Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: September 9, 2024
- Added to the CISA list
- August 19, 2024
- Published
- January 24, 2024
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- >99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-27
- More details
- NVD · CVE.org · CISA
All references (5)
- https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314
- https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
- http://www.openwall.com/lists/oss-security/2024/01/24/6
- http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html
- http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html
More exploited flaws from Jenkins
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 2, 2025 | Remote Code Execution | Jenkins | Critical 9.8 | 99.7% |
| May 12, 2023 | User Interface (UI) Information Disclosure | Jenkins User Interface (UI) | High 7.5 | 23% |
| Apr 25, 2022 | Sandbox Bypass | Script Security Plugin | Critical 9.9 | 74% |
| Mar 25, 2022 | Remote Code Execution | Matrix Project Plugin | Critical 9.9 | 97% |
| Feb 10, 2022 | Stapler Web Framework Deserialization of Untrusted Data | Jenkins Stapler Web Framework | Critical 9.8 | 98% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.