What is CVE-2024-23897?

CVE-2024-23897 is a critical security vulnerability affecting Jenkins, an open-source automation server used for building, testing, and deploying software. It allows unauthenticated attackers to read arbitrary files on the Jenkins controller file system due to a feature in the CLI command parser that replaces an '@' character followed by a file path with the file's contents. This vulnerability poses a significant risk to affected systems and requires immediate attention.

Who is impacted by CVE-2024-23897?

This vulnerability affects users of Jenkins, an open-source automation server for building, testing, and deploying software. Specifically, it impacts Jenkins versions 2.441 and earlier, as well as LTS versions 2.426.2 and earlier. This critical vulnerability allows unauthenticated attackers to read arbitrary files on the Jenkins controller file system, posing a significant risk to affected systems.

What should I do if I’m affected?

If you're affected by the CVE-2024-23897 vulnerability, it's crucial to take immediate action to secure your Jenkins system. Here's a simple, step-by-step guide to help you:

1. Update Jenkins to version 2.442 or LTS 2.426.3, which contain fixes for the vulnerability. See the Jenkins Security Advisory for more information.

2. Regularly check for updates and security advisories to stay informed about potential risks and solutions.

3. Consider subscribing to the oss-security mailing list for updates on security vulnerabilities in Jenkins and other open-source software.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-23897 vulnerability in Jenkins is not listed in CISA's Known Exploited Vulnerabilities Catalog. This critical vulnerability allows unauthenticated attackers to read arbitrary files on the Jenkins controller file system. It affects Jenkins versions 2.441 and earlier, as well as LTS versions 2.426.2 and earlier. To address this issue, update Jenkins to version 2.442 or LTS 2.426.3, which contain fixes for the vulnerability.

Weakness Enumeration

The weakness enumeration for this vulnerability is Insufficient Information , indicating a lack of specific details about the vulnerability and its mitigation.

Learn More

For a comprehensive understanding of its description, severity, technical details, and known affected software configurations, refer to the NVD page and the resources listed below.

• Jenkins 2.441 / LTS 2.426.3 CVE-2024-23897 Scanner

• Multiple vulnerabilities in Jenkins and Jenkins plugins

• Jenkins Security Advisory 2024-01-24