# CVE-2024-23897 is vulnerable for jenkins 2.263.1

**URL:** <https://community.jenkins.io/t/cve-2024-23897-is-vulnerable-for-jenkins-2-263-1/12130>\
**Category:** Using Jenkins\
**Tags:** question, jenkinsfile\
**Created:** [January 31, 2024, 8:31am UTC](https://community.jenkins.io/t/cve-2024-23897-is-vulnerable-for-jenkins-2-263-1/12130 "2024-01-31T08:31:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shivkumar](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@shivkumar](https://community.jenkins.io/u/shivkumar)\
**Post date:** [January 31, 2024, 8:31am UTC](https://community.jenkins.io/t/cve-2024-23897-is-vulnerable-for-jenkins-2-263-1/12130/1 "2024-01-31T08:31:28Z")

</div>

Hi,  
We are using Jenkins 2.263.1 our organization came to know there is a vulnerable threat CVE-2024-23897.  
Can any one give a solution whether this vulnerability affect our version.  
If it does what can be done from our side.

---

<div class="post-metadata">

**Author:** ![mawinter69](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mawinter69/32/1625_2.png) [@mawinter69](https://community.jenkins.io/u/mawinter69)\
**Post date:** [January 31, 2024, 8:41am UTC](https://community.jenkins.io/t/cve-2024-23897-is-vulnerable-for-jenkins-2-263-1/12130/2 "2024-01-31T08:41:11Z")

</div>

I would say yes you’re affected see [Jenkins Security Advisory 2024-01-24](https://www.jenkins.io/security/advisory/2024-01-24/)  
The page describes what you can do

1. Upgrade to latest LTS (strongly recommended)
2. Disable CLI

---

<div class="post-metadata">

**Author:** ![Mridula03g](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mridula03g/32/6892_2.png) [@Mridula03g](https://community.jenkins.io/u/Mridula03g)\
**Post date:** [February 1, 2024, 11:34am UTC](https://community.jenkins.io/t/cve-2024-23897-is-vulnerable-for-jenkins-2-263-1/12130/3 "2024-02-01T11:34:08Z")

</div>

Hi @mawinter69

Can you kindly provide the steps to disable the cli, because i followed the steps from below link and i can see below error  
link:[GitHub - jenkinsci-cert/SECURITY-3314-3315: Workaround for disabling the CLI to mitigate SECURITY-3314/CVE-2024-23897 and SECURITY-3315/CVE-2024-23898](https://github.com/jenkinsci-cert/SECURITY-3314-3315/?tab=readme-ov-file)  
Error:

groovy.lang.MissingMethodException: No signature of method: static jenkins.model.Jenkins.get() is applicable for argument types: () values:   
Possible solutions: getMe(), grep(), grep(java.lang.Object), getAt(java.lang.String), wait(), getACL()  
at groovy.lang.MetaClassImpl.invokeStaticMissingMethod(MetaClassImpl.java:1501)  
at groovy.lang.MetaClassImpl.invokeStaticMethod(MetaClassImpl.java:1487)  
at org.codehaus.groovy.runtime.callsite.StaticMetaClassSite.call(StaticMetaClassSite.java:53)  
at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:48)  
at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:113)  
at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:117)  
at Script1.run(Script1.groovy:5)  
at groovy.lang.GroovyShell.evaluate(GroovyShell.java:585)  
at groovy.lang.GroovyShell.evaluate(GroovyShell.java:623)  
at groovy.lang.GroovyShell.evaluate(GroovyShell.java:594)  
at hudson.util.RemotingDiagnostics$Script.call(RemotingDiagnostics.java:142)  
at hudson.util.RemotingDiagnostics$Script.call(RemotingDiagnostics.java:114)  
at hudson.remoting.LocalChannel.call(LocalChannel.java:45)  
at hudson.util.RemotingDiagnostics.executeGroovy(RemotingDiagnostics.java:111)  
at jenkins.model.Jenkins.\_doScript(Jenkins.java:4367)  
at jenkins.model.Jenkins.doScript(Jenkins.java:4338)  
at java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:627)  
at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:343)  
at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:184)  
at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:117)  
at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:129)  
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)  
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:715)  
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:845)  
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:649)  
at org.kohsuke.stapler.Stapler.service(Stapler.java:238)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)  
at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:841)  
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1650)  
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:135)  
at org.jenkinsci.plugins.ssegateway.Endpoint$SSEListenChannelFilter.doFilter(Endpoint.java:225)  
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:132)  
at io.jenkins.blueocean.auth.jwt.impl.JwtAuthenticationFilter.doFilter(JwtAuthenticationFilter.java:61)  
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:132)  
at io.jenkins.blueocean.ResourceCacheControl.doFilter(ResourceCacheControl.java:134)  
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:132)  
at net.bull.javamelody.MonitoringFilter.doFilter(MonitoringFilter.java:232)  
at net.bull.javamelody.MonitoringFilter.doFilter(MonitoringFilter.java:209)  
at net.bull.javamelody.PluginMonitoringFilter.doFilter(PluginMonitoringFilter.java:88)  
at org.jvnet.hudson.plugins.monitoring.HudsonMonitoringFilter.doFilter(HudsonMonitoringFilter.java:113)  
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:132)  
at hudson.plugins.greenballs.GreenBallFilter.doFilter(GreenBallFilter.java:59)  
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:132)  
at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:138)  
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)  
at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:49)  
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)  
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)  
at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)  
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)  
at jenkins.security.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:117)  
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)  
at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)  
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)  
at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)  
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)  
at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)  
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)  
at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:72)  
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)  
at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)  
at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)  
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)  
at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:90)  
at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)  
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)  
at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:49)  
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)  
at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:82)  
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)  
at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)  
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1637)  
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:533)  
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)  
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:524)  
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)  
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:190)  
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595)  
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188)  
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253)  
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168)  
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)  
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564)  
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166)  
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155)  
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)  
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)  
at org.eclipse.jetty.server.Server.handle(Server.java:564)  
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:317)  
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)  
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)  
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:110)  
at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)  
at org.eclipse.jetty.util.thread.Invocable.invokePreferred(Invocable.java:128)  
at org.eclipse.jetty.util.thread.Invocable$InvocableExecutor.invoke(Invocable.java:222)  
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:294)  
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:199)  
at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)  
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)  
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)  
at java.lang.Thread.run(Thread.java:748)

Thank you

---

<div class="post-metadata">

**Author:** ![mawinter69](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mawinter69/32/1625_2.png) [@mawinter69](https://community.jenkins.io/u/mawinter69)\
**Post date:** [February 1, 2024, 1:49pm UTC](https://community.jenkins.io/t/cve-2024-23897-is-vulnerable-for-jenkins-2-263-1/12130/4 "2024-02-01T13:49:03Z")

</div>

@Mridula03g are you running a very old Jenkins version older than 2.98?  
If yes you would need to use  
`jenkins.model.Jenkins.getInstance()`