Lucene search

PRIOn knowledge basePRION:CVE-2024-23904

HistoryJan 24, 2024 - 6:15 p.m.

Double free

2024-01-2418:15:00

PRIOn knowledge base

www.prio-n.com

jenkins

log command plugin

vulnerability

unauthenticated attackers

file system

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.9%

JSON

Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an ‘@’ character followed by a file path in an argument with the file’s contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.

CPENameOperatorVersion
log_commandle1.0.2

CPE	Name	Operator	Version
	log_command	le	1.0.2

References

www.openwall.com/lists/oss-security/2024/01/24/6

www.jenkins.io/security/advisory/2024-01-24/