CVE-2023-35141: CSRF
In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-35141?
CVE-2023-35141 is a vulnerability in Jenkins 2.399 and earlier LTS 2.387.3 and earlier, where POST requests are sent in order to load the list of context actions.
What is the severity of CVE-2023-35141?
The severity of CVE-2023-35141 is high, with a severity value of 8.
How does CVE-2023-35141 affect Jenkins?
CVE-2023-35141 affects Jenkins versions 2.399 and earlier, as well as LTS versions 2.387.3 and earlier.
What is the CWE category for CVE-2023-35141?
CVE-2023-35141 is categorized under CWE-352.
How can I fix CVE-2023-35141?
To fix CVE-2023-35141, it is recommended to update Jenkins to version 2.400 (for non-LTS) or version 2.401.1 (for LTS).