Riskcovery

CVE-2023-43496

State
Published
Severity
8.8 High
Published
Sep 20, 2023
Updated
May 2, 2025
Reserved
Sep 19, 2023

Read the record on cve.org

Description

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-276 Incorrect Default Permissions

Affected Products

ProductVersions
JenkinsJenkins Project
  • 2.424 and laterNot affected
  • 2.414.2 to before 2.414.*Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.