{"id":"CVE-2024-23897","kind":"vulnerability","aliases":["CVE-2024-23897"],"related":[],"title":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that…","description":"Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Jenkins CLI has a path traversal flaw that lets an attacker read certain files on the Jenkins server. Reading those files can lead to code execution, and CISA lists it as actively exploited with ransomware use.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-08-19T00:00:00+00:00","products":[{"name":"Jenkins Jenkins Command Line Interface (CLI)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"jenkins","fixed":["2.426.3"],"affected":"< 2.426.3","ecosystem":"vendor"},{"name":"jenkins","fixed":["2.442"],"affected":"< 2.442","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","jenkins","package","ransomware","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations per the Jenkins vendor instructions, or discontinue use of the product if mitigations are unavailable.","status":"open","published_at":"2024-01-24T18:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:23+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:58:23Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations per the Jenkins vendor instructions, or discontinue use of the product if mitigations are unavailable.","reach":"network","impact":"high","summary":"Jenkins CLI has a path traversal flaw that lets an attacker read certain files on the Jenkins server. Reading those files can lead to code execution, and CISA lists it as actively exploited with ransomware use.","category":"package","who_cares":["jenkins","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads sensitive server files and may achieve code execution.","analyst_note":"Find the Jenkins security advisory for CVE-2024-23897 for affected and fixed versions, the mitigation steps, and the detection method (for example, checking whether the CLI endpoint is exposed).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000463,"input_tokens":2851,"output_tokens":356,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':20A,23A '-23897':21A,24A '2.426.2':6A '2.441':2A 'access':91C 'action':103C 'activ':71B 'allow':87C 'appli':104C 'attack':50B,88C 'certain':52B,93C 'cisa':67B,101C 'cli':16A,30A,41B,80C 'code':64B,99C 'command':17A,27A,77C 'contain':81C 'cve':19A,22A 'disabl':11A 'discontinu':110C 'earlier':4A,8A 'execut':65B,100C 'exploit':33B,72B 'featur':13A 'file':53B,60B,94C 'flaw':46B 'host':39B 'instruct':108C 'interfac':79C 'interface':29A 'jenkin':1A,34B,40B,56B,76C 'jenkins':25A,26A,31A,32A 'lead':62B,97C 'let':48B 'limit':89C 'line':28A,78C 'list':68B 'lts':5A 'mitig':105C,116C 'packag':35B 'parser':18A 'path':44B,83C 'per':106C 'product':114C 'ransomwar':36B,74B 'read':51B,58B,90C 'requir':102C 'self':38B 'self-host':37B 'server':57B 'travers':45B,84C 'unavail':118C 'use':75B,111C 'vendor':107C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-01-24T18:15:09+00:00","kev":{"dateAdded":"2024-08-19","dueDate":"2024-09-09","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-23897","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-23897","severity":null,"published_at":"2024-08-19T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-23897","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23897","severity":null,"published_at":"2024-01-24T18:15:09+00:00","modified_at":"2026-06-17T07:13:49+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}