Podatność CVE-2024-23897
Publikacja: 2024-01-24

Opis:
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

W naszej bazie, znaleźliśmy następujące noty dla tego CVE:
Tytuł
Autor
Data
Med.
Jenkins 2.441 Local File Inclusion
Matisse Beckandt
15.04.2024

Typ:

CWE-98

 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP File Inclusion'))

 Referencje:
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314
http://www.openwall.com/lists/oss-security/2024/01/24/6
Copyright 2024, cxsecurity.com

 

Back to Top