Lucene search
+L

7 matches found

Kitploit
Kitploit
added 2026/09/04 4:53 a.m.4 views

CVE-2024-23897

CVE-2024-23897 Jenkins CVE-2024-23897: 任意文件读取漏洞导致远程代码执行 Jenkins 使用 args4j 库来解析 CLI 命令中的命令参数和选项。该命令解析器具有一个特性,当参数中包含 @ 字符后跟文件路径时,会用文件内容替换该参数(expandAtFiles)。该特性默认启用,且 Jenkins 2.441 及更早版本、LTS 2.426.2 及更早版本未禁用此功能。 这使得攻击者能够使用 Jenkins 控制器进程的默认字符编码读取 Jenkins 控制器文件系统上的任意文件。 拥有 Overall/Read 权限的攻击者可以读取完整的文件...

9.8CVSS8.7AI score0.99999EPSS
SaveExploits50
Kitploit
Kitploit
added 2026/09/02 1:40 a.m.4 views

CVE-2024-23897

Jenkinsには、スクリプトやシェル環境からJenkinsにアクセスするためのコマンドラインインターフェース(CLI)が組み込まれています。 Jenkinsは、CLIコマンドを処理する際に、Jenkinsコントローラ上でコマンド引数とオプションを解析するためにargs4jライブラリを使用しています。このコマンドパーサーには、引数内の@文字に続くファイルパスをファイルの内容に置き換える機能(expandAtFiles)があります。この機能はデフォルトで有効になっており、Jenkins 2.441以前およびLTS 2.426.2以前では無効化されません。...

9.8CVSS8.7AI score0.99999EPSS
SaveExploits50
RedHat Linux
RedHat Linux
added 2024/02/12 10:38 a.m.11 views

jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE

A flaw was found in Jenkins, which uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces the "@" character followed by a file path in an argument with the file’s contents expandAtFiles...

9.8CVSS7.2AI score0.99999EPSS
SaveExploits50References7
RedHat Linux
RedHat Linux
added 2024/02/12 10:26 a.m.11 views

jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE

A flaw was found in Jenkins, which uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces the "@" character followed by a file path in an argument with the file’s contents expandAtFiles...

9.8CVSS7.3AI score0.99999EPSS
SaveExploits50References7
GithubExploit
GithubExploit
added 2024/01/28 1:57 a.m.1128 views

Exploit for Path Traversal in Jenkins

CVE-2024-23897 This repository presents a proof-of-concept of...

9.8CVSS9.2AI score0.99999EPSS
SaveExploits50
RedhatCVE
RedhatCVE
added 2024/01/25 8:21 p.m.160 views

CVE-2024-23897

A flaw was found in Jenkins, which uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces the "@" character followed by a file path in an argument with the file’s contents expandAtFiles...

9.8CVSS8.5AI score0.99999EPSS
SaveExploits50References6
Github Security Blog
Github Security Blog
added 2024/01/24 6:31 p.m.100 views

Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character...

9.8CVSS8.5AI score0.99999EPSS
SaveExploits50References11Affected Software1
Rows per page
Query Builder