Description

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents.

Remediation

References

https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-1807

Related Vulnerabilities

CVE-2023-29514 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui

CVE-2012-5883 Vulnerability in npm package yui

CVE-2023-29209 Vulnerability in maven package org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro

CVE-2012-3373 Vulnerability in maven package org.apache.wicket:wicket

CVE-2021-41183 Vulnerability in maven package org.webjars.bowergithub.jquery:jquery-ui

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory NVD-CWE-noinfo