CVE-2023-35141

2023-06-1412:53:05

jenkins

www.cve.org

cve-2023-35141

jenkins

lts

context actions

post requests

security vulnerability

user-provided values

context menu

endpoint

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

44.2%

JSON

In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Jenkins",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThan": "*",
        "status": "unaffected",
        "version": "2.400",
        "versionType": "maven"
      }
    ]
  }
]