CVE-2023-32986

Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters…

High · published May 16, 2023

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1
8.8
EPSS
61%
Percentile
99.1
In the wild
Unconfirmed
What it is

Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.60683 · 99.1th percentile
Published
2023-05-16T16:00Z
EPSS history
Timeline
  • 16 MAY 16:00Z
    Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters…
    cvelistv5