PT-2023-31643 · Jenkins · Jenkins Htmlresource Plugin+1

Kevin Guerroudj · Publicado 2023-12-13 · Atualizado 2023-12-18 · CVE-2023-50774

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins HTMLResource Plugin versions 1.02 and earlier

Description A cross-site request forgery (CSRF) issue allows attackers to delete arbitrary files on the Jenkins controller file system. This can be exploited by attackers to potentially disrupt or compromise the system.

Recommendations For Jenkins HTMLResource Plugin versions 1.02 and earlier, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the plugin to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-50774

GHSA-7CCG-JM7J-4F8V

Produtos afetados

Jenkins

Jenkins Htmlresource Plugin

Referências · 8

• https://t.me/cvenotify/63935 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-7ccg-jm7j-4f8v · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-50774 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2023-12-13/#SECURITY-3183 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50774 · Nota de Segurança
• http://openwall.com/lists/oss-security/2023/12/13/4 · Nota
• https://twitter.com/VulmonFeeds/status/1734995494563180939 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1734991768628650241 · Publicação no Twitter