CVE-2023-40338: Jenkins Folders Plugin information disclosure vulnerability
Summary
CVE-2023-40338: Jenkins Folders Plugin information disclosure vulnerability. Affects org.jenkins-ci.plugins:cloudbees-folder versions < 6.848.ve3b. Fixed in 6.848.ve3b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Folders Plugin is a component of the Jenkins automation server that allows users to organize their Jenkins jobs into folders. It provides a hierarchical structure for managing and categorizing jobs, making it easier to navigate and organize large numbers of jobs. The plugin is widely used in Jenkins installations and is an integral part of many Jenkins workflows.
Vulnerability Detail
The Jenkins Folders Plugin is affected by an information disclosure vulnerability. When attempting to access the Scan Organization Folder Log, the plugin displays an error message if no logs are available. However, in versions 6.846.v23698686f0f6 and earlier, this error message includes the absolute path of a log file, exposing sensitive information about the Jenkins controller file system. An attacker with access to the error message could potentially gain insights into the file system structure and use this information for further attacks or unauthorized access. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 6.1106.v3a_d9a_6d2465e as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.848.ve3b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the Folders Plugin.
Conclusion
The Jenkins Folders Plugin is affected by an information disclosure vulnerability that exposes sensitive information about the Jenkins controller file system. Upgrading to the latest version of the Folders Plugin (6.848.ve3b_fd7839a_81 or later) is recommended to mitigate this vulnerability. No known workarounds exist, and it is important to apply the fix to ensure the security of your Jenkins installation. For further support, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:cloudbees-folder →
FAQ
The vulnerability exposes sensitive information about the Jenkins controller file system, potentially aiding attackers in further attacks or unauthorized access.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix to mitigate the risk of potential attacks.
Manually modifying the plugin code to remove the exposed log file path is not recommended, as it may introduce other issues or conflicts with future plugin updates. It is best to apply the fix by upgrading to the latest version of the Folders Plugin.
For further support on vulnerability remediation and assistance with upgrading the Folders Plugin, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:cloudbees-folder.
