CVE-2024-23897

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 100.00%
EPSS Percentile: 100.00%
CISA KEV: YES — Known Exploited Vulnerability

Description

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 25-Jan-2024 01:15
Last Modified: 17-Jun-2026 14:13
EPSS Date: 2026-11-08
CWE: CWE-22, CWE-27

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2024-08-19
Remediation Due: 2024-09-09
Known Ransomware Campaign Use: Known
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314; https://nvd.nist.gov/vuln/detail/CVE-2024-23897

CNA Products / Version Status

jenkins · jenkins Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: affected

0 ≤ version < 1.606 — unaffected (maven)
2.442 ≤ version < * — unaffected (maven)
2.426.3 ≤ version < 2.427 — unaffected (maven)
2.440.1 ≤ version < 2.441 — unaffected (maven)

CPEs: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
Jenkins Project · Jenkins Source: CNA · [email protected]
Default status: affected

0 ≤ version < 1.606 — unaffected (maven)
2.442 ≤ version < * — unaffected (maven)
2.426.3 ≤ version < 2.426.* — unaffected (maven)
2.440.1 ≤ version < 2.440.* — unaffected (maven)

Affected Products / Versions

jenkins / jenkins Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.426.3
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
jenkins / jenkins Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.442
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*

References

Last enrichment sync: 09-Nov-2026 14:07
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

[CVE IDs ] Exploited/publicly referenced vulnerabilities used for initial access or privilege escalation – CVE-2024-23897 (Jenkins), CVE-2016-5195 (Linux Dirty COW), and other CVEs listed (and 4 more CVEs). Earth Lusca Adds Go-Based KTLVdoor Backdoor to Its Espionage Toolkit

CVE (1)

Malware (8)

Threat Actors (13)

MITRE ATT&CK (5)

Products (3)

Tools (1)

Industries (7)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.