CVE-2023-35141

2023-06-1413:15:11

CWE-352

jenkins

web.nvd.nist.gov

cve-2023-35141

jenkins

lts

post requests

security

vulnerability

nvd

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

44.2%

JSON

In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.

Affected configurations

Nvd

Node

jenkinsjenkinsRange<2.400-

jenkinsjenkinsRange<2.401.1lts

VendorProductVersionCPE
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*

Vendor	Product	Version	CPE
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins:::::-:::*
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins:::::lts:::*

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Jenkins",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThan": "*",
        "status": "unaffected",
        "version": "2.400",
        "versionType": "maven"
      }
    ]
  }
]