# Discrepancy between Jenkins Documentation and CVE Sources for CVE-2024-23897

**URL:** <https://community.jenkins.io/t/discrepancy-between-jenkins-documentation-and-cve-sources-for-cve-2024-23897/12879>\
**Category:** Using Jenkins\
**Tags:** sig-security\
**Created:** [February 28, 2024, 2:12pm UTC](https://community.jenkins.io/t/discrepancy-between-jenkins-documentation-and-cve-sources-for-cve-2024-23897/12879 "2024-02-28T14:12:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![security\_dude\_2323](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@security\_dude\_2323](https://community.jenkins.io/u/security_dude_2323)\
**Post date:** [February 28, 2024, 2:12pm UTC](https://community.jenkins.io/t/discrepancy-between-jenkins-documentation-and-cve-sources-for-cve-2024-23897/12879/1 "2024-02-28T14:12:36Z")

</div>

It appears as though there is a discrepancy between the Jenkins Security Advisory: [Jenkins Security Advisory 2024-01-24](https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314) and the CVE listing in [NVD - CVE-2024-23897 (nist.gov)](https://nvd.nist.gov/vuln/detail/CVE-2024-23897#VulnChangeHistorySection)

NVD NIST shows that versions 2.441 and earlier or 2.426.2 or earlier are vulnerable. While the Jenkins security advisory has those two, but a callout that 2.440.1 is safe. This is a pretty major discrepancy and should be corrected in one of the two areas so that the community can be aware of which version they need to update to.