CVE-2023-43498
Jenkins Project Jenkins
HIGH 8.1
At a glance
- Source
- NVD
- EPSS
- EPSS 0.97 % · percentile 62 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- jenkins
- NVD status
- Modified
Description
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
Weaknesses (CWE)
- CWE-377 — DEPRECATED: Insecure Temporary File
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-hq87-h4jg-vxfw — Jenkins temporary uploaded file created with insecure permissions
European references
- ENISA EUVD · EUVD-2023-2526
- GCVE · GCVE-0-2023-43498
Affected configurations (NVD CPE)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*< 2.414.2cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*< 2.424
Affected products
| Product | Versions |
|---|---|
| Jenkins Project · Jenkins | unaffected 2.424 < * ; unaffected 2.414.2 < 2.414.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |