In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/09/20/5 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
23 Sep 2023, 03:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Jenkins
Jenkins jenkins |
|
| CPE | cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* |
|
| CWE | CWE-434 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| References | (MISC) https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073 - Vendor Advisory | |
| References | (MISC) http://www.openwall.com/lists/oss-security/2023/09/20/5 - Mailing List, Third Party Advisory |
20 Sep 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Sep 2023, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-20 17:15
Updated : 2023-12-10 15:14
NVD link : CVE-2023-43497
Mitre link : CVE-2023-43497
CVE.ORG link : CVE-2023-43497
JSON object : View
Products Affected
jenkins
- jenkins
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type