GitHub Advisoryadvisory · Maven

GHSA-36hq-v2fc-rpqp Jenkins Folders Plugin information disclosure vulnerability

MEDIUM Published 2023-08-16 Modified 2023-08-16 Official page ↗
Aliases
CVE-2023-40338
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:cloudbees-folder
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209, CWE-532
Reviewed
2023-08-16

Affected packages

• Maven org.jenkins-ci.plugins:cloudbees-folder: < 6.848.ve3b → fixed in 6.848.ve3b

Description

Jenkins Folders Plugin displays an error message when attempting to access the Scan Organization Folder Log if no logs are available. In Folders Plugin 6.846.v23698686f0f6 and earlier, this error message includes the absolute path of a log file, exposing information about the Jenkins controller file system. Folders Plugin 6.848.ve3b_fd7839a_81 does not display the absolute path of a log file in the error message.

Related

Alias · CVE (1)

  • CVE-2023-40338 Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when… vulnerability

Weakness · CWE (2)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References