Lucene search

JenkinsCVE-2023-37960

HistoryJul 12, 2023 - 4:15 p.m.

CVE-2023-37960

2023-07-1216:15:13

CWE-22

jenkins

web.nvd.nist.gov

jenkins

mathworks

polyspace plugin

cve-2023-37960

security vulnerability

arbitrary files

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

27.8%

JSON

Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file systems.

Affected configurations

Nvd

Node

jenkinsmathworks_polyspaceRange≤1.0.5jenkins

VendorProductVersionCPE
jenkinsmathworks_polyspace*cpe:2.3:a:jenkins:mathworks_polyspace:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	mathworks_polyspace	*	cpe:2.3:a:jenkins:mathworks_polyspace::::::jenkins::*

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Jenkins MathWorks Polyspace Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "1.0.5",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2023/07/12/2

www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3124

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

27.8%

JSON

Related for CVE-2023-37960