Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary
    directory with the default permissions for newly created files when installing a plugin from a URL,
    potentially allowing attackers with access to the system temporary directory to replace the file before it
    is installed in Jenkins, potentially resulting in arbitrary code execution. (CVE-2023-43496)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 402fccd0-5b6d-11ee-9898-00e081b7aa2d advisory.

  - Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude     sensitive build variables (e.g., password parameter values) from the search in the build history widget,     allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by     iteratively testing different characters until the correct sequence is discovered. (CVE-2023-43494)

  - Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor     parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability     exploitable by attackers able to control this parameter. (CVE-2023-43495)

  - Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary     directory with the default permissions for newly created files when installing a plugin from a URL,     potentially allowing attackers with access to the system temporary directory to replace the file before it     is installed in Jenkins, potentially resulting in arbitrary code execution. (CVE-2023-43496)

  - In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web     framework creates temporary files in the default system temporary directory with the default permissions     for newly created files, potentially allowing attackers with access to the Jenkins controller file system     to read and write the files before they are used. (CVE-2023-43497)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.414.2 or Jenkins weekly prior to 2.424. It is, therefore, affected by multiple vulnerabilities:

  - Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude     sensitive build variables (e.g., password parameter values) from the search in the build history widget,     allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by     iteratively testing different characters until the correct sequence is discovered. (CVE-2023-43494)

  - In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web     framework creates temporary files in the default system temporary directory with the default permissions     for newly created files, potentially allowing attackers with access to the Jenkins controller file system     to read and write the files before they are used. (CVE-2023-43497)

  - In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using     MultipartFormDataParser creates temporary files in the default system temporary directory with the default     permissions for newly created files, potentially allowing attackers with access to the Jenkins controller     file system to read and write the files before they are used. (CVE-2023-43498)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
410604	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-55wp-3pq4-w8p9)	Tenable Cloud Security	SCA Checks	high
410604	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-55wp-3pq4-w8p9)	Tenable Self-Hosted Container Security	SCA Checks	high
181837	FreeBSD : jenkins -- multiple vulnerabilities (402fccd0-5b6d-11ee-9898-00e081b7aa2d)	Nessus	FreeBSD Local Security Checks	high
181682	Jenkins LTS < 2.414.2 / Jenkins weekly < 2.424 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2023-43496

high

Tenable Plugins

high

high

high

high