BIT-jenkins-2023-43498

BIT-jenkins-2023-43498 PUBLISHED CVSS 8.100000381469727 HIGH

In Jenkins LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.

Risk Scores

CVSS 3.1

8.100000381469727

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Bitnami	jenkins	0, 0, 0

Timeline

Mar 6, 2024 CVE Published
Apr 3, 2025 CVE Updated

References

http://www.openwall.com/lists/oss-security/2023/09/20/5 url
https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073 url
https://nvd.nist.gov/vuln/detail/CVE-2023-43498 url

Open in Interactive Console →