File Parameter Security Flaw in Jenkins File Parameter Plugin
CVE-2023-32986

8.8HIGH

Key Information:

Vendor

Jenkins
Status
Jenkins File Parameter Plugin
Vendor
CVE Published:
16 May 2023

What is CVE-2023-32986?

The Jenkins File Parameter Plugin prior to version 285.v757c5b_67a_c25 is vulnerable due to insufficient restrictions on Stashed File Parameters. This flaw permits users with Item/Configure permission to manipulate the names of uploaded Stashed File Parameters. As a result, malicious actors can create or overwrite files on the Jenkins controller's file system with arbitrary content, leading to potential unauthorized access and file integrity issues. Users are recommended to upgrade to a secure version to mitigate these risks.

Affected Version(s)

Jenkins File Parameter Plugin 0 <= 285.v757c5b_67a_c25

References

https://www.jenkins.io/security/advisory/2023-05-16/#SECU...
vendor-advisory

EPSS Score

60% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.