CVE-2024-23904

Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.
Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:log_command:*:*:*:*:*:jenkins:*:*

History

29 Jan 2024, 19:26

Type Values Removed Values Added
First Time Jenkins
Jenkins log Command
CPE cpe:2.3:a:jenkins:log_command:*:*:*:*:*:jenkins:*:*
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
References () http://www.openwall.com/lists/oss-security/2024/01/24/6 - () http://www.openwall.com/lists/oss-security/2024/01/24/6 - Mailing List, Third Party Advisory
References () https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3334 - () https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3334 - Vendor Advisory

24 Jan 2024, 18:45

Type Values Removed Values Added
New CVE

Information

Published : 2024-01-24 18:15

Updated : 2024-02-28 20:54


NVD link : CVE-2024-23904

Mitre link : CVE-2024-23904

CVE.ORG link : CVE-2024-23904


JSON object : View

Products Affected

jenkins

  • log_command