CVE-2023-40336: Jenkins Folders Plugin cross-site request forgery vulnerability
Summary
CVE-2023-40336: Jenkins Folders Plugin cross-site request forgery vulnerability. Affects org.jenkins-ci.plugins:cloudbees-folder versions < 6.848.ve3b. Fixed in 6.848.ve3b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Folders Plugin is a Maven-based package that provides functionality for organizing and managing Jenkins projects into folders. It allows users to create a hierarchical structure to better organize their projects. The plugin is widely used in Jenkins installations to improve project management and organization.
Vulnerability Detail
The Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier is vulnerable to a cross-site request forgery (CSRF) attack. This vulnerability occurs because the plugin does not require POST requests for an HTTP endpoint, making it susceptible to unauthorized actions. An attacker can exploit this vulnerability to copy an item, potentially leading to the automatic approval of unsandboxed scripts and the execution of unsafe scripts. This can result in unauthorized access, data leakage, and potential compromise of the Jenkins environment.
How To Fix
Minimum fixed version
6.848.ve3b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the Jenkins Folders Plugin to address the CSRF vulnerability effectively.
Conclusion
The Jenkins Folders Plugin is vulnerable to a cross-site request forgery (CSRF) attack, which can lead to unauthorized access and potential compromise of the Jenkins environment. It is crucial to update to the fixed version of the plugin (6.848.ve3b_fd7839a_81 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:cloudbees-folder →
FAQ
This vulnerability allows attackers to copy items in Jenkins, potentially leading to the automatic approval of unsandboxed scripts and the execution of unsafe scripts. It can result in unauthorized access, data leakage, and compromise of the Jenkins environment.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity level.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to address the vulnerability promptly by updating to the fixed version of the Jenkins Folders Plugin.
No, the recommended mitigation is to update to the fixed version of the Jenkins Folders Plugin. There are no known workarounds or alternative solutions to address this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:cloudbees-folder.
