GHSA-qjpf-2jhx-3758

Source

https://github.com/advisories/GHSA-qjpf-2jhx-3758

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-qjpf-2jhx-3758/GHSA-qjpf-2jhx-3758.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qjpf-2jhx-3758

Aliases

CVE-2024-23904

Published

2024-01-24T18:31:02Z

Modified

2025-06-20T22:35:29.965447Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Arbitrary file read vulnerability in Jenkins Log Command Plugin

Details

Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed_at": "2024-01-24T21:51:30Z",
    "nvd_published_at": "2024-01-24T18:15:09Z",
    "severity": "HIGH"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:log-command

Package

Name: org.jenkins-ci.plugins:log-command; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/log-command

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.0.2

Affected versions

1.*

1.0.0

1.0.1

1.0.2