PT-2023-27394 · Jenkins · Jenkins Folders Plugin+1

Kevin Guerroudj · CVE-2023-40336 · Publicado 2023-08-16 · Atualizado 2023-08-22

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Folders Plugin versions 6.846.v23698686f0f6 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to copy folders, potentially leading to the automatic approval of unsandboxed scripts and the execution of unsafe scripts. This issue arises because the plugin does not require POST requests for a specific HTTP endpoint.

Recommendations For versions 6.846.v23698686f0f6 and earlier, update to version 6.848.ve3b fd7839a 81 or later, which requires POST requests for the affected HTTP endpoint, mitigating the CSRF vulnerability.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-40336

GHSA-4VQP-PCM3-73XP

RHSA-2024:0777

Produtos afetados

Jenkins

Jenkins Folders Plugin

Referências · 8

• https://jenkins.io/security/advisory/2023-08-16/#SECURITY-3106 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40336 · Nota de Segurança
• https://twitter.com/CVEnew/status/1691822012270866690 · Publicação no Twitter
• https://t.me/cvenotify/56791 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-4vqp-pcm3-73xp · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1691852949075493252 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-40336 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/08/16/3 · Nota