CVE-2024-23897

This report describes a Jenkins vulnerability in args4j where CLI arguments beginning with '@' are interpreted as file inclusions, allowing attackers to read arbitrary files from the Jenkins controller; the issue is exacerbated by insecure settings (Allow users to register, Enable anonymous read permission) and can be exploited via jenkins-cli.jar or crafted POST requests to /cli?remoting=false to exfiltrate file contents.