CVE-2023-27903

2023-03-1021:15:15

CWE-863

[email protected]

web.nvd.nist.gov

cve-2023-27903

jenkins

temporary file

default permissions

file parameter

cli

unauthorized access

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

6.7

Confidence

Low

EPSS

Percentile

9.0%

JSON

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used.