PT-2023-27394 · Jenkins · Jenkins Folders Plugin+1

Kevin Guerroudj · Published 2023-08-16 · Updated 2023-08-22 · CVE-2023-40336

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Folders Plugin versions 6.846.v23698686f0f6 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to copy folders, potentially leading to the automatic approval of unsandboxed scripts and the execution of unsafe scripts. This issue arises because the plugin does not require POST requests for a specific HTTP endpoint.

Recommendations For versions 6.846.v23698686f0f6 and earlier, update to version 6.848.ve3b fd7839a 81 or later, which requires POST requests for the affected HTTP endpoint, mitigating the CSRF vulnerability.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-40336

GHSA-4VQP-PCM3-73XP

RHSA-2024:0777

Affected Products

Jenkins

Jenkins Folders Plugin

References · 8

• https://jenkins.io/security/advisory/2023-08-16/#SECURITY-3106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40336 · Security Note
• https://osv.dev/vulnerability/GHSA-4vqp-pcm3-73xp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40336 · Vendor Advisory
• https://twitter.com/CVEnew/status/1691822012270866690 · Twitter Post
• https://t.me/cvenotify/56791 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1691852949075493252 · Twitter Post
• http://openwall.com/lists/oss-security/2023/08/16/3 · Note