CVE-2023-40338

Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing information about the Jenkins controller file system.

Score

CVSS 3.1 4.3 Medium

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2023-08-16

Last modified

2024-08-02

Weaknesses

CWE-532

Affected products

• Folders (Jenkins)
• Jenkins Folders Plugin (Jenkins Project)

References

• http://www.openwall.com/lists/oss-security/2023/08/16/3
• https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3109