PT-2023-31643 · Jenkins · Jenkins Htmlresource Plugin+1

Kevin Guerroudj · Published 2023-12-13 · Updated 2023-12-18 · CVE-2023-50774

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins HTMLResource Plugin versions 1.02 and earlier

Description A cross-site request forgery (CSRF) issue allows attackers to delete arbitrary files on the Jenkins controller file system. This can be exploited by attackers to potentially disrupt or compromise the system.

Recommendations For Jenkins HTMLResource Plugin versions 1.02 and earlier, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the plugin to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-50774

GHSA-7CCG-JM7J-4F8V

Affected Products

Jenkins

Jenkins Htmlresource Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-7ccg-jm7j-4f8v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50774 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-12-13/#SECURITY-3183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50774 · Security Note
• https://t.me/cvenotify/63935 · Telegram Post
• http://openwall.com/lists/oss-security/2023/12/13/4 · Note
• https://twitter.com/VulmonFeeds/status/1734995494563180939 · Twitter Post
• https://twitter.com/CVEnew/status/1734991768628650241 · Twitter Post