CVE-2024-23899: jenkins project jenkins git server plugin Path Traversal

Vulnerability summary

CVE-2024-23899 is a medium (CVSS 6.5) Path Traversal vulnerability in jenkins project jenkins git server plugin. EPSS estimates a 1.26% chance of exploitation in the next 30 days, higher than 69.2% of scored vulnerabilities.

Timeline

1. 24-01-2024
   PublishedVulnerability first disclosed.
2. 04-06-2025
   Last modifiedVulnerability information updated.

Description

Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.