CVE-2023-43496

2023-09-2016:06:10

jenkins

www.cve.org

jenkins

vulnerability

temporary file

plugin installation

system directory

arbitrary code execution

cve-2023-43496

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.1%

JSON

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Jenkins",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThan": "*",
        "status": "unaffected",
        "version": "2.424",
        "versionType": "maven"
      },
      {
        "lessThan": "2.414.*",
        "status": "unaffected",
        "version": "2.414.2",
        "versionType": "maven"
      }
    ]
  }
]