Vulnerabilitycritical
CI/CD at Risk as Exploits Released For Critical Jenkins Bug
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-23897 | Path Traversal in Jenkins CLI Allows File Read and Code Execution | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2024-23898 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI… | 8.8 | 67% |
From the original article
1 min read at infosecurity-magazine.com
Software developers have been told to urgently patch their Jenkins servers after exploits were published for a new critical vulnerability in the product. CVE-2024-23897 could allow unauthenticated attackers with “overall/read” permission to read arbitrary files on the Jenkins controller file system. Even those without these permissions would be able to read the first few lines of files, according to Jenkins.
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.