CVE-2023-32986

2023-05-1616:15:11

CWE-732

[email protected]

web.nvd.nist.gov

cve-2023-32986

jenkins file parameter plugin

arbitrary file creation

nvd

information security

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.0%

JSON

Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Affected configurations

NVD

Node

jenkinsfile_parametersRange≤285.287.v4b_7b_29d3469djenkins

CPENameOperatorVersion
jenkins:file_parametersjenkins file parametersle285.287.v4b_7b_29d3469d

CPE	Name	Operator	Version
jenkins:file_parameters	jenkins file parameters	le	285.287.v4b_7b_29d3469d

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Jenkins File Parameter Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "285.v757c5b_67a_c25",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]