CVE-2023-43498
highPriorität · verfolgen · 32EPSS 0.010 · 61. PerzentilDEEURUUSEPSS · bewertet 2026-10-23
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 3.6–8.1
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (10)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2023-2411Jenkins: Mehrere SchwachstellenDeutsch2023-09-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, XSS-Angriffe durchzuführen, Dateien zu manipulieren oder Cross-Site Request Forgery-Angriffe durchzuführen.
- GHSA-hq87-h4jg-vxfwJenkins temporary uploaded file created with insecure permissions2023-09-20ghsa · osvUS
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, uploaded files processed via the Stapler web framework and the Jenkins API `MultipartFormDataParser` create temporary files in the system temporary directory with the default permissions for newly created files. If these permissions are overly permissive, attackers with access to the system temporary directory may be able to read and write the file before it is used. This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allow attackers to read the temporary file, but not write to it. Jenkins 2.424, LTS 2.414.2 creates the temporary files in a subdirectory with more restrictive permissions. As a workaround, you can change your default temporary-file directory using the Java system property `java.io.tmpdir`, if you’re concerned about this issue but unable to immediately update Jenkins.
- BIT-jenkins-2023-434982024-03-06vendor · osvUS
In Jenkins LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2023/09/20/5cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-43498/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.5437cnnvd
- https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073cnnvd
- http://www.openwall.com/lists/oss-security/2023/09/20/5enisa_euvd
- https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073enisa_euvd
- http://www.openwall.com/lists/oss-security/2023/09/20/5Mailing ListThird Party Advisorynvd
- https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073Vendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan