Advisory 49 : Jenkins Vulnerability Advisory
Release Date : 24th of January 2024
Impact : HIGH / CRITICAL
TLP Rating: Clear 
CERT Vanuatu (CERTVU) and the Office of the Chief Information Officer (OGCIO) provide the following advisory.
What is it?
These are Multiple vulnerabilities affecting Jenkins products which could result in Remote Code Execution and Cross-site webSocket hijacking.
CVE-2024-23897 refers to a Critical Vulnerability in the command line interface command parser allowing attackers to read arbitrary files on the Jenkins controller file system, resulting in possible Remote Code Execution.
CVE-2024-23898 refers to a High vulnerability which enables cross-site WebSocket Hijacking in the command line interface, resulting in the potential threat actors to execute CLI command on the Jenkins controller.
What are the Systems affected?
A list of affected versions included here: https://www.jenkins.io/security/advisory/2024-01-24/
- Jenkins (Core)
- Git Server Plugin
- GitLab Branch Plugin
- Log Command Plugin
- Matrix Project Plugin
- Qualys Policy Compliance Scanning Connector Plugin
- Red Hat Dependency Analytics Plugin
What this means?
An attacker could exploit this vulnerability and take control of the affected system.
Mitigation process
Administrators are recommended to review their network for use of vulnerability Jenkins Products and upgrade to Jenkins 2.442 or LTS 2.426.3.
References
- https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/multiple-vulnerabilities-jenkins-products
- https://www.jenkins.io/security/advisory/2024-01-24/
- https://nvd.nist.gov/vuln/detail/CVE-2024-23897
- Download advisory (English): Jenkins Vulnerability Advisory
- Download advisory (Bislama): Advaeseri long saed blong Jenkins Vulnerabiliti
- Download advisory (French): Alerte sur les vulnérabilités dans Jenkins