PT-2023-21408 · Jenkins · Jenkins

Markus Winter · Publicado 2023-03-08 · Atualizado 2025-02-28 · CVE-2023-27902

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.393 and earlier Jenkins LTS versions 2.375.3 and earlier Jenkins versions prior to LTS 2.387.1

Description The issue allows attackers with Item/Workspace permission to access the contents of temporary directories related to job workspaces. These temporary directories are used by Jenkins to store temporary files related to the build and may contain credentials stored by Jenkins-controlled processes.

Recommendations For Jenkins versions 2.393 and earlier, consider updating to version 2.394 or later. For Jenkins LTS versions 2.375.3 and earlier, consider updating to version 2.375.4 or later. For versions prior to LTS 2.387.1, consider updating to version LTS 2.387.1 or later. As a temporary workaround, do not grant Item/Workspace permission to users who lack Item/Configure permission.

Exploit

Correção

Identificadores relacionados

BIT-JENKINS-2023-27902

CVE-2023-27902

GHSA-CJ6R-8PXJ-5JV6

RHSA-2023:3299

Produtos afetados

Jenkins

Referências · 10

• 🔥 https://github.com/CVEProject/cvelist/blob/master/2023/27xxx/CVE-2023-27902.json · Exploit
• https://github.com/jenkinsci/jenkins/commit/80452662b31ac6c9f4418cffae1af6af4daf479a · Nota
• https://jenkins.io/security/advisory/2023-03-08/#SECURITY-1807 · Aviso do Fabricante
• https://t.me/cibsecurity/59856 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27902 · Aviso do Fabricante
• https://t.me/cvenotify/112865 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-cj6r-8pxj-5jv6 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-jenkins-2023-27902 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27902 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27902 · Nota