Is CVE-2024-23897 exploited in the wild?

Yes. CVE-2024-23897 is known to be exploited in the wild, first recorded on 19 August 2024. Treat it as urgent.

How severe is CVE-2024-23897?

Critical severity, with a CVSS score of 3.1, published 24 January 2024.

Which products and versions are affected?

org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=1.606,fixed=2.426.3.

Is there a fix for CVE-2024-23897?

Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.426.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-23897 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-23897?

Check whether you run Jenkins Command Line Interface (CLI) or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-23897: Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

CVE-2024-23897 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2024-01-24

The Jenkins Command Line Interface (CLI) fails to disable a feature in its command parser that replaces an '@' character followed by a file path with the file's contents. This path traversal vulnerability allows unauthenticated attackers to read arbitrary files on the Jenkins controller file system, potentially leading to remote code execution.

Technologies: org.jenkins-ci.main:jenkins-core (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2024-23897 exploited in the wild?: Yes. CVE-2024-23897 is known to be exploited in the wild, first recorded on 19 August 2024. Treat it as urgent.
How severe is CVE-2024-23897?: Critical severity, with a CVSS score of 3.1, published 24 January 2024.
Which products and versions are affected?: org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=1.606,fixed=2.426.3.
Is there a fix for CVE-2024-23897?: Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.426.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-23897 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-23897?: Check whether you run Jenkins Command Line Interface (CLI) or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.426.3 or later

# set org.jenkins-ci.main:jenkins-core to 2.426.3 in your pom.xml or build.gradle

Affected products

Jenkins Project Jenkins up to 2.441
Jenkins Project Jenkins LTS up to 2.426.2

Identifiers

CVE-2024-23897
GHSA-6f9g-cxwr-q5jr

Timeline

2024-01-24: disclosed: Vendor advisory SECURITY-3314 published.
2024-08-19: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
2024-08-19: other: Vulnerability published to NVD.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.