We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-23899



Assignerjenkins
Reserved2024-01-23
Published2024-01-24
Updated2024-10-18

Description

Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system.

Product status

Default status
unaffected

Any version
affected

References

https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3319 (Jenkins Security Advisory 2024-01-24) vendor-advisory

http://www.openwall.com/lists/oss-security/2024/01/24/6

cve.org CVE-2024-23899

nvd.nist.gov CVE-2024-23899

Download JSON

Share this page
https://cve.threatint.com
Subscribe to our newsletter to learn more about our work.