CVE-2023-43498

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-43498", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2023-09-19T09:22:58.130Z", "datePublished": "2023-09-20T16:06:40.956Z", "dateUpdated": "2024-09-24T18:52:38.402Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Jenkins", "vendor": "Jenkins Project", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.424", "versionType": "maven"}, {"lessThan": "2.414.*", "status": "unaffected", "version": "2.414.2", "versionType": "maven"}]}], "descriptions": [{"lang": "en", "value": "In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T12:52:04.805Z"}, "references": [{"name": "Jenkins Security Advisory 2023-09-20", "tags": ["vendor-advisory"], "url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073"}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/20/5"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:44:42.284Z"}, "title": "CVE Program Container", "references": [{"name": "Jenkins Security Advisory 2023-09-20", "tags": ["vendor-advisory", "x_transferred"], "url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073"}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/20/5", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-377", "lang": "en", "description": "CWE-377 Insecure Temporary File"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-24T18:51:41.983850Z", "id": "CVE-2023-43498", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T18:52:38.402Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073", "name": "Jenkins Security Advisory 2023-09-20", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/20/5", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:44:42.284Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-43498", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-24T18:51:41.983850Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-377", "description": "CWE-377 Insecure Temporary File"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T18:52:28.012Z"}}], "cna": {"affected": [{"vendor": "Jenkins Project", "product": "Jenkins", "versions": [{"status": "unaffected", "version": "2.424", "lessThan": "*", "versionType": "maven"}, {"status": "unaffected", "version": "2.414.2", "lessThan": "2.414.*", "versionType": "maven"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073", "name": "Jenkins Security Advisory 2023-09-20", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/20/5"}], "descriptions": [{"lang": "en", "value": "In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T12:52:04.805Z"}}}, "cveMetadata": {"cveId": "CVE-2023-43498", "state": "PUBLISHED", "dateUpdated": "2024-09-24T18:52:38.402Z", "dateReserved": "2023-09-19T09:22:58.130Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2023-09-20T16:06:40.956Z", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Jenkins", "vendor": "Jenkins Project", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.424", "versionType": "maven"}, {"lessThan": "2.414.*", "status": "unaffected", "version": "2.414.2", "versionType": "maven"}]}], "source": "jenkinsci-cert@googlegroups.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*", "matchCriteriaId": "C2F4A98B-D78F-4DCD-BC55-30B060433845", "versionEndExcluding": "2.414.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*", "matchCriteriaId": "D532EC73-64F8-46D5-8240-863B264D13D6", "versionEndExcluding": "2.424", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used."}, {"lang": "es", "value": "En Jenkins versi\u00f3n 2.423 y anteriores, LTS versi\u00f3n 2.414.1 y anteriores, el procesamiento de cargas de archivos utilizando MultipartFormDataParser crea archivos temporales en el directorio temporal predeterminado del sistema con los permisos predeterminados para archivos reci\u00e9n creados, lo que potencialmente permite a los atacantes con acceso al sistema de archivos del controlador Jenkins leer y escriba los archivos antes de usarlos."}], "id": "CVE-2023-43498", "lastModified": "2026-06-17T06:25:36.580", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-43498", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-09-24T18:51:41.983850Z", "version": "2.0.3"}}]}, "published": "2023-09-20T17:15:11.927", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/09/20/5"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/09/20/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-377"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "jenkins: API MultipartFormDataParser temporary uploaded file created with insecure permissions", "id": "2240096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2240096"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-378", "details": ["In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.", "A flaw was found in Jenkins weekly and LTS due to an issue when processing file uploads using the MultipartFormDataParser. By sending a specially crafted request, a local authenticated attacker could bypass security restrictions and access the Jenkins controller file system to read and write the files before they are used."], "name": "CVE-2023-43498", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "jenkins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Out of support scope", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2023-09-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-43498\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-43498\nhttps://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073"], "threat_severity": "Low"}

{}