Information Disclosure in Jenkins Log Command Plugin by Jenkins

CVE-2024-23904

What is CVE-2024-23904?

The Log Command Plugin for Jenkins versions 1.0.2 and earlier is vulnerable due to a flaw in its command parser feature. This vulnerability allows unauthenticated attackers to exploit the ability to include file paths prefixed by an '@' character. When triggered, the parser expands these paths, leading to sensitive information disclosure by reading arbitrary files from the Jenkins controller's file system. This poses a significant security risk, particularly in environments where sensitive configurations or credentials may be stored in files accessible by the plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References