CVE-2023-35141

Description

Jenkins provides context menus for various UI elements, like links to jobs and builds, or breadcrumbs. In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint (e.g., the Script Console) by opening a context menu. As of publication of this advisory, we are aware of insufficiently escaped context menu URLs for label expressions, allowing attackers with Item/Configure permissions to exploit this vulnerability. Jenkins 2.400, LTS 2.401.1 sends GET requests to load the list of context actions.

How to fix CVE-2023-35141

To remediate CVE-2023-35141, upgrade the affected package to a fixed version below.

• —upgrade to 2.401.1 or later
• —upgrade to 2.400 or later

Is CVE-2023-35141 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2.401.1
• from 0, < 2.400

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-35141
• WEBgithub.com/CVEProject/cvelist/blob/f37e157216b8e5e64a6db80b7b68bde0088277fe/2023/35xxx/CVE-2023-35141
• WEBwww.jenkins.io/security/advisory/2023-06-14/#SECURITY-3135
• WEBwww.openwall.com/lists/oss-security/2023/06/14/5