CVE-2023-35141 – org.jenkins-ci.main:jenkins-core

Package

Manager: maven
Name: org.jenkins-ci.main:jenkins-core
Vulnerable Version: >=0 <2.400

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00163 pctl0.37711

Details

Jenkins CSRF protection bypass vulnerability Jenkins provides context menus for various UI elements, like links to jobs and builds, or breadcrumbs. In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint (e.g., the Script Console) by opening a context menu. As of publication of this advisory, we are aware of insufficiently escaped context menu URLs for label expressions, allowing attackers with Item/Configure permissions to exploit this vulnerability. Jenkins 2.400, LTS 2.401.1 sends GET requests to load the list of context actions.

Metadata

Created: 2023-06-14T15:30:37Z
Modified: 2023-06-14T20:28:01Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-98fp-r22g-wpj7/GHSA-98fp-r22g-wpj7.json
CWE IDs: ["CWE-352"]
Alternative ID: GHSA-98fp-r22g-wpj7
Finding: F007
Auto approve: 1