"45k Jenkins Servers at Risk of Remote Code Execution Attacks"
TL;DR
Approximately 45,000 Jenkins servers are vulnerable to a critical remote code execution (RCE) flaw, CVE-2024-23897, due to a feature that allows attackers to read arbitrary files on the Jenkins controller's file system. Multiple public proof-of-concept exploits are in circulation, dramatically elevating the risk for unpatched Jenkins servers. The exposure heatmap indicates a massive attack surface, with most vulnerable instances in China and the United States. Administrators are urged to apply security updates immediately or consult the Jenkins security bulletin for mitigation recommendations and potential workarounds.
- 45k Jenkins servers exposed to RCE attacks using public exploits BleepingComputer
- Critical Jenkins Vulnerability Exposes Servers to RCE Attacks - Patch ASAP! The Hacker News
- Exploits released for critical Jenkins RCE flaw, patch now BleepingComputer
- Critical Jenkins Vulnerability Leads to Remote Code Execution SecurityWeek
- Critical Jenkins Vulnerability Let Attackers Execute Remote Code CybersecurityNews
Want the full story? Read the original reporting
Read on BleepingComputer