ClosedCriticalPatched

Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE

Jenkins Command Line Interface (CLI)

Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. Added to the CISA KEV catalog on 2024-08-19. CISA lists known use in ransomware campaigns.

Why this severity: CVSS 9.8 (v3.1, CISA-ADP), actively exploited (CISA KEV); known ransomware use

Started: Jan 24, 2024
Closed: Aug 19, 2024
CVE: CVE-2024-23897

Updated Aug 19, 2024

Affected

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier (Jenkins advisory)

Fixed in

Jenkins 2.442
LTS 2.426.3
LTS 2.440.1

Timeline3

Aug 19, 2024
CISA added CVE-2024-23897 to the KEV catalog (federal deadline 2024-09-09)
Source
Jan 24, 2024
CVE-2024-23897 published
Source
Jan 24, 2024
Jenkins security advisory and fixed releases
Source

Advisories4

Notes & caveats

Derived from the CISA KEV JSON feed (catalogVersion 2026.10.21); CVSS from the CVE record (cveawg.mitre.org). startedAt is the CVE publication date when it fell in 2024 before the KEV listing, else the KEV dateAdded; exploitation may have begun earlier. closedAt is the KEV listing date (a fix or mitigation was available then unless noted).

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified