CVE-2024-23899

Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system.
Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:git_server:*:*:*:*:*:jenkins:*:*

History

31 Jan 2024, 18:43

Type Values Removed Values Added
CPE cpe:2.3:a:jenkins:git_server:*:*:*:*:*:jenkins:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.5
First Time Jenkins git Server
Jenkins
References () http://www.openwall.com/lists/oss-security/2024/01/24/6 - () http://www.openwall.com/lists/oss-security/2024/01/24/6 - Mailing List, Third Party Advisory
References () https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3319 - () https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3319 - Vendor Advisory
CWE NVD-CWE-noinfo

24 Jan 2024, 18:45

Type Values Removed Values Added
New CVE

Information

Published : 2024-01-24 18:15

Updated : 2024-02-28 20:54


NVD link : CVE-2024-23899

Mitre link : CVE-2024-23899

CVE.ORG link : CVE-2024-23899


JSON object : View

Products Affected

jenkins

  • git_server