What is CVE-2023-43498?

CVE-2023-43498 is a high-severity vulnerability in Jenkins, classified under Insecure Temporary File. CVSS score: 8.1/10. Published 2023-09-20.

How severe is CVE-2023-43498?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Jenkins

CVE-2023-43498

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentiall…

EPSS: 0.008 (52.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Jenkins
Jenkins Project — versions 2.424, 2.414.2

Weakness classification (CWE)

CWE-377 — Insecure Temporary File

References

jenkinsci-cert@googlegroups.com (vendor-advisory, Vendor Advisory)
jenkinsci-cert@googlegroups.com (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2023-43498?: CVE-2023-43498 is a high-severity vulnerability in Jenkins, classified under Insecure Temporary File. CVSS score: 8.1/10. Published 2023-09-20.
How severe is CVE-2023-43498?: High severity. CVSS v3 base score is 8.1 out of 10.