Security Vulnerabilities fixed in Jenkins 2024-01-24

Description

File inclusion via '@', missing origin validation, timing attack, CSP disable allow attackers to read/modify files, execute commands, hijack sessions, XSS/XXE, Jenkins core <=2.441/LTS<=2.426.2, Git server <=99.va_0826a_b_cdfa_d, Matrix <=822.v01b_8c85d16d2, GitLab <=684.vea_fa_7c1e2fe3.

Outbreak Alert

Cyber threat actors target Jenkins Arbitrary File Read vulnerability (CVE-2024-23897) in ransomware attacks. FortiGuard Labs continues to see active attack telemetry targeting the vulnerability.

View the full Outbreak Alert Report

Affected Applications

Jenkins

References