CVE-2023-43496

Jenkins LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when i...

Original description

The description as published by the source.

Jenkins LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami jenkins

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.424.0"}]}]

References

advisory openwall.com
advisory jenkins.io
web nvd.nist.gov