High severityNVD Advisory· Published Jan 24, 2024· Updated Jun 4, 2025
CVE-2024-23899
CVE-2024-23899
Description
Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:git-serverMaven | < 99.101.v720e86326c09 | 99.101.v720e86326c09 |
Affected products
2- Range: 0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-vph5-2q33-7r9hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-23899ghsaADVISORY
- www.jenkins.io/security/advisory/2024-01-24/ghsavendor-advisoryWEB
- www.openwall.com/lists/oss-security/2024/01/24/6ghsaWEB
- github.com/jenkinsci/git-server-plugin/commit/068ac7cc2574882ef9f5a486e001228a71d881adghsaWEB
News mentions
1- Jenkins Security Advisory 2024-01-24Jenkins Security Advisories · Jan 24, 2024