CVE-2023-35141

In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions

High · published June 14, 2023

CVSS v3.1
8.0
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00860 · 58.1th percentile
Published
2023-06-14T12:53Z
EPSS history
Timeline
  • 14 JUN 12:53Z
    In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions
    cvelistv5