BIT-jenkins-2023-43496

BIT-jenkins-2023-43496 PUBLISHED CVSS 8.800000190734863 HIGH

Jenkins LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.

Risk Scores

CVSS 3.1

8.800000190734863

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Bitnami	jenkins	0, 0, 0

Timeline

Mar 6, 2024 CVE Published
Apr 3, 2025 CVE Updated

References

http://www.openwall.com/lists/oss-security/2023/09/20/5 url
https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3072 url
https://nvd.nist.gov/vuln/detail/CVE-2023-43496 url

Open in Interactive Console →