CVE coverage
View on NVD →
CVE-2024-23897
CVSS 9.8
Actively exploited (KEV)
1 detection found
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Jenkins Arbitrary File Read CVE-2024-23897 | production | 2026-05-13 |