CVE-2024-23897

Confirmed PUBLISHED

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by...

Jenkins Project · Jenkins

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 100.0%

At a Glance

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

windows malware ransomware nessus_scanner nuclei_scanner cisa

CVE Published: Jan 24, 2024
Exploitation Reported: Aug 19, 2024
CVSS: 9.8 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
jenkins	jenkins	0 to < 1.606	Unaffected
jenkins	jenkins	2.442 to < *	Unaffected
jenkins	jenkins	2.426.3 to < 2.427	Unaffected
jenkins	jenkins	2.440.1 to < 2.441	Unaffected
jenkins	jenkins	0 to < 1.606	Unaffected
jenkins	jenkins	2.442 to < *	Unaffected
jenkins	jenkins	2.426.3 to < 2.427	Unaffected
jenkins	jenkins	2.440.1 to < 2.441	Unaffected
jenkins	jenkins	0 to < 1.606	Unaffected
jenkins	jenkins	2.442 to < *	Unaffected
jenkins	jenkins	2.426.3 to < 2.427	Unaffected
jenkins	jenkins	2.440.1 to < 2.441	Unaffected
jenkins	jenkins	0 to < 1.606	Unaffected
jenkins	jenkins	2.442 to < *	Unaffected
jenkins	jenkins	2.426.3 to < 2.427	Unaffected
jenkins	jenkins	2.440.1 to < 2.441	Unaffected
Jenkins Project	Jenkins	0 to < 1.606	Unaffected
Jenkins Project	Jenkins	2.442 to < *	Unaffected
Jenkins Project	Jenkins	2.426.3 to < 2.426.*	Unaffected
Jenkins Project	Jenkins	2.440.1 to < 2.440.*	Unaffected

CVE References

Jenkins Security Advisory 2024-01-24 jenkins.io · Vendor Advisory https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314
sonarsource.com/blog/excessive-expansion-uncovering-critical... sonarsource.com · CVE Record https://www.sonarsource.com/blog/excessive-expansion-uncovering-criti...
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2024/01/24/6
packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3...
packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbit... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2024-08-19 00:00 UTC
The Shadowserver	2026-05-27 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-23897.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2024-08-19 00:00:00 UTC · CISA

Used in malware

Recorded 2024-08-19 00:00:00 UTC · CISA

Proof of concept available

Recorded 2024-01-27 19:34:48 UTC · GitHub

Weaknesses (CWE)

CWE-27

Path Traversal: 'dir/../../filename'

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-23897.yaml	Apr 25, 2025
Nessus	https://www.tenable.com/plugins/nessus/194437	Apr 30, 2024

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

verylazytech/CVE-2024-23897

github · Created 2024-09-30 16:38:28 UTC · 8 stars

POC - Jenkins File Read Vulnerability - CVE-2024-23897

Maalfer/CVE-2024-23897

github · Created 2024-05-16 09:32:51 UTC · 8 stars

Poc para explotar la vulnerabilidad CVE-2024-23897 en versiones 2.441 y anteriores de Jenkins, mediante la cual podremos leer archivos internos del sistema sin estar autenticados

mil4ne/CVE-2024-23897-Jenkins-4.441

github · Created 2024-05-08 02:28:46 UTC · 5 stars

ThatNotEasy/CVE-2024-23897

github · Created 2024-02-19 02:29:12 UTC · 2 stars

Perform with massive Jenkins Reading-2-RCE

godylockz/CVE-2024-23897

github · Created 2024-02-16 07:16:04 UTC · 26 stars

POC for CVE-2024-23897 Jenkins File-Read

Praison001/CVE-2024-23897-Jenkins-Arbitrary-Read-File-Vulnerability

github · Created 2024-02-07 15:07:37 UTC · 3 stars

kaanatmacaa/CVE-2024-23897

github · Created 2024-02-04 20:56:42 UTC · 18 stars

Nuclei template for CVE-2024-23897 (Jenkins LFI Vulnerability)

viszsec/CVE-2024-23897

github · Created 2024-01-29 04:41:53 UTC · 5 stars

Jenkins POC of Arbitrary file read vulnerability through the CLI can lead to RCE

Vozec/CVE-2024-23897

github · Created 2024-01-28 01:57:06 UTC · 16 stars

This repository presents a proof-of-concept of CVE-2024-23897

wjlin0/CVE-2024-23897

github · Created 2024-01-27 19:34:48 UTC · 78 stars

CVE-2024-23897 - Jenkins 任意文件读取利用工具

10T4/PoC-Fix-jenkins-rce_CVE-2024-23897

github · Created 2024-01-27 13:27:57 UTC · 5 stars

on this git you can find all information on the CVE-2024-23897

AiK1d/CVE-2024-23897

github · Created 2024-01-27 12:57:28 UTC · 15 stars

CVE-2024-23897 jenkins-cli

yoryio/CVE-2024-23897

github · Created 2024-01-27 04:35:20 UTC · 2 stars

Scanner for CVE-2024-23897 - Jenkins

xaitax/CVE-2024-23897

github · Created 2024-01-26 19:00:03 UTC · 73 stars

CVE-2024-23897 | Jenkins <= 2.441 & <= LTS 2.426.2 PoC and scanner.

h4x0r-dz/CVE-2024-23897

github · Created 2024-01-26 09:44:32 UTC · 198 stars

CVE-2024-23897

binganao/CVE-2024-23897

github · Created 2024-01-26 08:02:00 UTC · 100 stars

Jenkins < 2.441 - Arbitrary File Read

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

27 May 2026 00:00 UTC about 2 months ago

27 May 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
19 Aug 2024 00:00 UTC almost 2 years ago

19 Aug 2024 00:00 UTC · almost 2 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
19 Aug 2024 00:00 UTC almost 2 years ago

19 Aug 2024 00:00 UTC · almost 2 years ago

First public exploitation report

Exploit observed in malware
30 Apr 2024 07:28 UTC about 2 years ago

30 Apr 2024 07:28 UTC · about 2 years ago

Nessus plugin available

Scanner coverage available
26 Jan 2024 08:02 UTC over 2 years ago

26 Jan 2024 08:02 UTC · over 2 years ago

Public PoC available

Public proof-of-concept code published
24 Jan 2024 17:52 UTC over 2 years ago

24 Jan 2024 17:52 UTC · over 2 years ago

CVE published

Vulnerability disclosed publicly
23 Jan 2024 12:46 UTC over 2 years ago

23 Jan 2024 12:46 UTC · over 2 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2024-23897

{
  "cve_id": "CVE-2024-23897",
  "title": "Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature...",
  "affected_vendor": "Jenkins Project",
  "affected_product": "Jenkins",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99999,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2024-23897

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API