PT-2023-21408 · Jenkins · Jenkins

Markus Winter · Published 2023-03-08 · Updated 2025-02-28 · CVE-2023-27902

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.393 and earlier Jenkins LTS versions 2.375.3 and earlier Jenkins versions prior to LTS 2.387.1

Description The issue allows attackers with Item/Workspace permission to access the contents of temporary directories related to job workspaces. These temporary directories are used by Jenkins to store temporary files related to the build and may contain credentials stored by Jenkins-controlled processes.

Recommendations For Jenkins versions 2.393 and earlier, consider updating to version 2.394 or later. For Jenkins LTS versions 2.375.3 and earlier, consider updating to version 2.375.4 or later. For versions prior to LTS 2.387.1, consider updating to version LTS 2.387.1 or later. As a temporary workaround, do not grant Item/Workspace permission to users who lack Item/Configure permission.

Exploit

Fix

Related Identifiers

BIT-JENKINS-2023-27902

CVE-2023-27902

GHSA-CJ6R-8PXJ-5JV6

RHSA-2023:3299

Affected Products

Jenkins

References · 10

• 🔥 https://github.com/CVEProject/cvelist/blob/master/2023/27xxx/CVE-2023-27902.json · Exploit
• https://jenkins.io/security/advisory/2023-03-08/#SECURITY-1807 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27902 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cj6r-8pxj-5jv6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2023-27902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27902 · Security Note
• https://github.com/jenkinsci/jenkins/commit/80452662b31ac6c9f4418cffae1af6af4daf479a · Note
• https://t.me/cibsecurity/59856 · Telegram Post
• https://t.me/cvenotify/112865 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27902 · Note