CVE-2023-35141

Name

CVE-2023-35141

Description

In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
MISC	https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3135
MISC	http://www.openwall.com/lists/oss-security/2023/06/14/5

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:jenkins:jenkins:::::lts:::*`	jenkins	>= None	< 2.401.1
`cpe:2.3:a:jenkins:jenkins:::::-:::*`	jenkins	>= None	< 2.400

References

Match rules

Vulnerable and fixed packages