CVEvulnerability
CVE-2023-35141
8.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-06-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.0 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.0 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-352
Description
In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.
Affected configurations
• jenkins jenkins (< 2.400)
• jenkins jenkins (< 2.401.1)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://www.openwall.com/lists/oss-security/2023/06/14/5 Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3135 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/06/14/5 Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3135 Vendor Advisory