CVE-2023-40336: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders.
Other sources
Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to copy an item, which could potentially automatically approve unsandboxed scripts and allow the execution of unsafe scripts.
Folders Plugin 6.848.ve3bfd7839a81 requires POST requests for the affected HTTP endpoint.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40336?
CVE-2023-40336 is a cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin.
What is the severity of CVE-2023-40336?
CVE-2023-40336 has a severity level of high.
How does CVE-2023-40336 affect Jenkins Folders Plugin?
CVE-2023-40336 allows attackers to copy an item and potentially automatically approve unsandboxed scripts.
How can I fix CVE-2023-40336 in Jenkins Folders Plugin?
To fix CVE-2023-40336, upgrade Jenkins Folders Plugin to version 6.848.ve3b or higher.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-40336?
The Common Weakness Enumeration (CWE) ID for CVE-2023-40336 is 352.