Security
1 min read0 views
CVE-2024-23897: Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character… (Update: proof of concept on GitHub published)
Update: proof of concept on GitHub published. Jenkins, an open-source automation server, is affected through its command-line interface (CLI) command parser. The flaw allows unauthenticated attackers to read arbitrary files from the Jenkins controller's file system, which could expose sensitive data such as credentials and configuration secrets.
Reading Level🟢Beginner
Listen to this article
Update: proof of concept on GitHub published. Jenkins, an open-source automation server, is affected through its command-line interface (CLI) command parser. The flaw allows unauthenticated attackers to read arbitrary files from the Jenkins controller's file system, which could expose sensitive data such as credentials and configuration secrets.
Original Source
cve.now CISA KEVLike this article
Share this article
Share:
Related Articles
CVE-2026-116606: Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway (Update: added to CISA KEV)
1 min read·1d ago
CVE-2026-111560: OS Command Injection in Barracuda Appliances (Update: added to CISA KEV)
1 min read·1d ago
CVE-2026-125350: Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a… (Update: added to CISA KEV)
1 min read·1d ago