CVE-2023-43497

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-43497", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2023-09-19T09:22:58.130Z", "datePublished": "2023-09-20T16:06:10.771Z", "dateUpdated": "2024-09-24T17:04:55.380Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Jenkins", "vendor": "Jenkins Project", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.424", "versionType": "maven"}, {"lessThan": "2.414.*", "status": "unaffected", "version": "2.414.2", "versionType": "maven"}]}], "descriptions": [{"lang": "en", "value": "In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T12:52:03.617Z"}, "references": [{"name": "Jenkins Security Advisory 2023-09-20", "tags": ["vendor-advisory"], "url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073"}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/20/5"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:44:42.280Z"}, "title": "CVE Program Container", "references": [{"name": "Jenkins Security Advisory 2023-09-20", "tags": ["vendor-advisory", "x_transferred"], "url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073"}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/20/5", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "jenkins", "product": "jenkins", "cpes": ["cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.423", "versionType": "maven"}, {"version": "0", "status": "affected", "lessThan": "lts_2.414.1", "versionType": "maven"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-24T17:01:04.100300Z", "id": "CVE-2023-43497", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T17:04:55.380Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073", "name": "Jenkins Security Advisory 2023-09-20", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/20/5", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:44:42.280Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-43497", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-24T17:01:04.100300Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*"], "vendor": "jenkins", "product": "jenkins", "versions": [{"status": "affected", "version": "0", "lessThan": "2.423", "versionType": "maven"}, {"status": "affected", "version": "0", "lessThan": "lts_2.414.1", "versionType": "maven"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T17:04:43.441Z"}}], "cna": {"affected": [{"vendor": "Jenkins Project", "product": "Jenkins", "versions": [{"status": "unaffected", "version": "2.424", "lessThan": "*", "versionType": "maven"}, {"status": "unaffected", "version": "2.414.2", "lessThan": "2.414.*", "versionType": "maven"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073", "name": "Jenkins Security Advisory 2023-09-20", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/20/5"}], "descriptions": [{"lang": "en", "value": "In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T12:52:03.617Z"}}}, "cveMetadata": {"cveId": "CVE-2023-43497", "state": "PUBLISHED", "dateUpdated": "2024-09-24T17:04:55.380Z", "dateReserved": "2023-09-19T09:22:58.130Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2023-09-20T16:06:10.771Z", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Jenkins", "vendor": "Jenkins Project", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.424", "versionType": "maven"}, {"lessThan": "2.414.*", "status": "unaffected", "version": "2.414.2", "versionType": "maven"}]}], "source": "jenkinsci-cert@googlegroups.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "jenkins", "vendor": "jenkins", "versions": [{"lessThan": "2.423", "status": "affected", "version": "0", "versionType": "maven"}, {"lessThan": "lts_2.414.1", "status": "affected", "version": "0", "versionType": "maven"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*", "matchCriteriaId": "C2F4A98B-D78F-4DCD-BC55-30B060433845", "versionEndExcluding": "2.414.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*", "matchCriteriaId": "D532EC73-64F8-46D5-8240-863B264D13D6", "versionEndExcluding": "2.424", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used."}, {"lang": "es", "value": "En Jenkins 2.423 y versiones anteriores, LTS 2.414.1 y anteriores, el procesamiento de cargas de archivos utilizando el framework web Stapler crea archivos temporales en el directorio temporal predeterminado del sistema con los permisos predeterminados para archivos reci\u00e9n creados, lo que potencialmente permite a los atacantes acceder al sistema de archivos del controlador Jenkins leer y escribir los archivos antes de utilizarlos."}], "id": "CVE-2023-43497", "lastModified": "2026-06-17T06:25:36.383", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-43497", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-09-24T17:01:04.100300Z", "version": "2.0.3"}}]}, "published": "2023-09-20T17:15:11.877", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/09/20/5"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/09/20/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "jenkins: Stapler web framework temporary uploaded file created with insecure permissions", "id": "2240095", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2240095"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-378", "details": ["In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.", "A flaw was found in Jenkins weekly and LTS due to an issue when processing file uploads using the Stapler web framework. By sending a specially crafted request, a local authenticated attacker could bypass security restrictions and access the Jenkins controller file system to read and write the files before they are used."], "name": "CVE-2023-43497", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "jenkins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Out of support scope", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2023-09-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-43497\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-43497"], "threat_severity": "Low"}

{}