CVE-2023-2196 Missing permission checks in Code Dx Plugin

Medium 4.3 Published 16 May 2023 Updated 22 Jan 2025

Attackers with Item/Read permission can check for the existence of arbitrary files on the agent file system due to missing permission checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-2196?

CVE-2023-2196 is a medium-severity path traversal vulnerability in Jenkins Code Dx Plugin, published on 16 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on an agent file system.

Weakness: CWE-22

Which versions are affected by CVE-2023-2196?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:codedx. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:codedx` Maven	All versions	`4.0.0`
`org.jenkins-ci.plugins:codedx` Maven	All versions	`4.0.0`

Products include Jenkins Code Dx.

How do I fix CVE-2023-2196?

Upgrade org.jenkins-ci.plugins:codedx to 4.0.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-2196 being exploited?

There is no known exploitation of CVE-2023-2196 in the wild and no public exploit code.

Sources

Also known as GHSA-5gjq-5339-x5cv.