BIT-jenkins-2023-43497

BIT-jenkins-2023-43497 PUBLISHED CVSS 8.100000381469727 HIGH

In Jenkins LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.

Risk Scores

CVSS 3.1

8.100000381469727

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Bitnami	jenkins	0, 0, 0

Timeline

Mar 6, 2024 CVE Published
Apr 3, 2025 CVE Updated

References

http://www.openwall.com/lists/oss-security/2023/09/20/5 url
https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073 url
https://nvd.nist.gov/vuln/detail/CVE-2023-43497 url

Open in Interactive Console →