CVE-2023-40337: Jenkins Folders Plugin cross-site request forgery vulnerability
Summary
CVE-2023-40337: Jenkins Folders Plugin cross-site request forgery vulnerability. Affects org.jenkins-ci.plugins:cloudbees-folder versions < 6.848.ve3b. Fixed in 6.848.ve3b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Folders Plugin is a Maven-based package that provides functionality for organizing and managing views within folders in the Jenkins automation server. It allows users to create a hierarchical structure for organizing their Jenkins views and projects. The plugin is widely used in Jenkins installations for better organization and management of projects.
Vulnerability Detail
The Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier is vulnerable to a cross-site request forgery (CSRF) attack. This vulnerability occurs because the plugin does not require POST requests for an HTTP endpoint, allowing attackers to forge requests and perform unauthorized actions. Specifically, this vulnerability allows attackers to copy a view inside a folder. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 6.1106.v3a_d9a_6d2465e as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.848.ve3b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the Jenkins Folders Plugin.
Conclusion
The Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier is vulnerable to a cross-site request forgery (CSRF) attack. This vulnerability allows attackers to copy a view inside a folder, potentially leading to unauthorized access or data leakage. To mitigate this vulnerability, it is crucial to upgrade to Jenkins Folders Plugin version 6.848.ve3b_fd7839a_81 or later. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:cloudbees-folder →
FAQ
This vulnerability allows attackers to copy a view inside a folder in Jenkins. While the impact may vary depending on the specific environment and configuration, it can potentially lead to unauthorized access, data leakage, or disruption of Jenkins workflows.
You can use Vulert's playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file for analysis.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fix promptly to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely. Attackers can craft malicious requests and trick authenticated users into executing unauthorized actions within the Jenkins environment.
For further support and assistance in remediating this vulnerability, you can reach out to info@devnack.com. Our team of experts will be happy to assist you in securing your Jenkins installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:cloudbees-folder.
