Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Mar 23, 2023 | Mar 9, 2023 |
| Jenkins 2023 03 08 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.394Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.375.4 | Mar 9, 2023 | Mar 8, 2023 |
| Redhat Openshift | — | Upgrade jenkins | May 10, 2023 | Mar 10, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub