CVE-2024-23904

🗓️ 24 Jan 2024 17:52:27Reported by jenkinsType

Jenkins Log Command Plugin 1.0.2 allows unauthenticated attackers to read arbitrary file

Reporter	Title	Published	Views	Family All 18
BDU FSTEC	The vulnerability of the Jenkins Git Log command’s plugin involves an incorrect restriction on the path name for the restricted directory. This allows a malicious user to read the content from any arbitrary file.	15 Apr 202400:00	–	bdu_fstec
Circl	CVE-2024-23904	24 Jan 202419:27	–	circl
CNNVD	Jenkins Plugin Log Command Security Vulnerability	24 Jan 202400:00	–	cnnvd
CVE	CVE-2024-23904	24 Jan 202417:52	–	cve
EUVD	EUVD-2024-0404	3 Oct 202520:07	–	euvd
Github Security Blog	Arbitrary file read vulnerability in Jenkins Log Command Plugin	24 Jan 202418:31	–	github
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2024-01-24)	24 Jan 202400:00	–	nessus
NCSC	Vulnerabilities fixed in Jenkins	25 Jan 202400:00	–	ncsc
NVD	CVE-2024-23904	24 Jan 202418:15	–	nvd
OSV	CVE-2024-23904	24 Jan 202418:15	–	osv

[
  {
    "vendor": "Jenkins Project",
    "product": "Jenkins Log Command Plugin",
    "versions": [
      {
        "version": "0",
        "versionType": "maven",
        "lessThanOrEqual": "1.0.2",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/01/24/6
jenkins	www.jenkins.io/security/advisory/2024-01-24/

24 Jan 2024 17:55Current

7.9High risk

Vulners AI Score7.9

EPSS0.00875