Vulnerabilitycritical

Critical Jenkins Vulnerability Exposes Servers to RCE Attacks

The Hacker Newsby @TheHackersNewsJan 29, 2024 · 03:45 UTC (Jan 29, 2024)2 min read3 · 1 read

Read at thehackernews.com

Analyze CVE-2024-23897 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2024-23897 CVE-2023-27898 CVE-2023-27905

Tags: cve-2024-23897 cve-2023-27898 cve-2023-27905 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-27898	Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when…	9.6	2%		Mar 10, 2023
CVE-2023-27905	Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored…	9.6	2%		Mar 10, 2023
CVE-2024-23897	Path Traversal in Jenkins CLI Allows File Read and Code Execution	9.8	100%	KEVRansomwarePoC ×3	Jan 24, 2024 KEV Aug 19, 2024

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Jan 25, 2024 Vulnerability / Software Security The maintainers of the open-source continuous integration/continuous delivery and deployment (CI/CD) automation software Jenkins have resolved nine security flaws, including a critical bug that, if successfully exploited, could result in remote code execution (RCE).

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.