CVE-2023-40338 Jenkins Folders Plugin information disclosure vulnerability
Attackers can view absolute file system paths via error messages when accessing missing logs, exposing internal Jenkins controller structure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40338?
CVE-2023-40338 is a medium-severity vulnerability in Jenkins Folders Plugin, published on 16 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing information about the Jenkins controller file system.
Weakness: CWE-532
Which versions are affected by CVE-2023-40338?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:cloudbees-folder. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:cloudbees-folder Maven | All versions | 6.848.ve3b |
org.jenkins-ci.plugins:cloudbees-folder Maven | All versions | 6.848.ve3b |
Products include Jenkins Folders.
How do I fix CVE-2023-40338?
Upgrade org.jenkins-ci.plugins:cloudbees-folder to 6.848.ve3b or later.
Is CVE-2023-40338 being exploited?
There is no known exploitation of CVE-2023-40338 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Folders Plugin
Sources
Also known as GHSA-36hq-v2fc-rpqp.