CVE-2024-23897: jenkins

csirt@kutim:~/threat-intel/cve/CVE-2024-23897

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 100,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada jenkins. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 19 Agustus 2024, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Rincian

Terbit di NVD: 24 Januari 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-27: Path Traversal: 'dir/../../filename'
EPSS (30 hari): 100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Masuk KEV: 19 Agustus 2024
Tenggat CISA: 9 September 2024 (untuk instansi federal AS)
Ransomware: Tercatat dipakai dalam kampanye ransomware
Tindakan wajib: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jenkins	jenkins	Semua versi sebelum 2.426.3
jenkins	jenkins	Semua versi sebelum 2.442

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314 advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897 pemerintah AS
http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html exploit · advisory pihak ketiga · vdb entry
https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1 exploit · advisory pihak ketiga
https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/ exploit · press/media coverage
http://www.openwall.com/lists/oss-security/2024/01/24/6 mailing list

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.