CVE-2023-27903 — Jenkins Project / Jenkins

Description (CNA)

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins	unaffected 2.394 before ; unaffected 2.375.4 before 2.375.; unaffected 2.387.1 before 2.387.*

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3058

ADP enrichment

CVE

No English description supplied.

https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3058

CISA-ADP

No English description supplied.

No references supplied.