CVE-2023-40337 - Vulnerability Details

Vendors	Products
Jenkins	Folders
Redhat	Ocp Tools

Package	CPE	Advisory	Released Date
OCP-Tools-4.12-RHEL-8
jenkins-2-plugins-0:4.12.1706515741-1.el8	cpe:/a:redhat:ocp_tools:4.12::el8	RHSA-2024:0778	2024-02-12T00:00:00Z
OCP-Tools-4.14-RHEL-8
jenkins-2-plugins-0:4.14.1706516441-1.el8	cpe:/a:redhat:ocp_tools:4.14::el8	RHSA-2024:0777	2024-02-12T00:00:00Z

Link	Providers
http://www.openwall.com/lists/oss-security/2023/08/16/3
https://nvd.nist.gov/vuln/detail/CVE-2023-40337
https://www.cve.org/CVERecord?id=CVE-2023-40337
https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-40337", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2023-08-14T16:02:56.435Z", "datePublished": "2023-08-16T14:32:50.031Z", "dateUpdated": "2024-10-08T17:52:04.237Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Jenkins Folders Plugin", "vendor": "Jenkins Project", "versions": [{"lessThanOrEqual": "6.846.v23698686f0f6", "status": "affected", "version": "0", "versionType": "maven"}]}], "descriptions": [{"lang": "en", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T12:51:20.506Z"}, "references": [{"name": "Jenkins Security Advisory 2023-08-16", "tags": ["vendor-advisory"], "url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105"}, {"url": "http://www.openwall.com/lists/oss-security/2023/08/16/3"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:31:53.670Z"}, "title": "CVE Program Container", "references": [{"name": "Jenkins Security Advisory 2023-08-16", "tags": ["vendor-advisory", "x_transferred"], "url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105"}, {"url": "http://www.openwall.com/lists/oss-security/2023/08/16/3", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-08T17:51:52.416142Z", "id": "CVE-2023-40337", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T17:52:04.237Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-40337 (string)

assignerOrgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

state : PUBLISHED (string)

assignerShortName : jenkins (string)

dateReserved : 2023-08-14T16:02:56.435Z (string)

datePublished : 2023-08-16T14:32:50.031Z (string)

dateUpdated : 2024-10-08T17:52:04.237Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Jenkins Folders Plugin (string)

vendor : Jenkins Project (string)

versions : [ »

0 : { »

lessThanOrEqual : 6.846.v23698686f0f6 (string)

status : affected (string)

version : 0 (string)

versionType : maven (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder. (string)

}

]

providerMetadata : { »

orgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

shortName : jenkins (string)

dateUpdated : 2023-10-24T12:51:20.506Z (string)

}

references : [ »

0 : { »

name : Jenkins Security Advisory 2023-08-16 (string)

tags : [ »

0 : vendor-advisory (string)

]

url : https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105 (string)

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2023/08/16/3 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T18:31:53.670Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : Jenkins Security Advisory 2023-08-16 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105 (string)

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2023/08/16/3 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-08T17:51:52.416142Z (string)

id : CVE-2023-40337 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-08T17:52:04.237Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105", "name": "Jenkins Security Advisory 2023-08-16", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/08/16/3", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:31:53.670Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-40337", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-08T17:51:52.416142Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T17:51:59.140Z"}}], "cna": {"affected": [{"vendor": "Jenkins Project", "product": "Jenkins Folders Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "6.846.v23698686f0f6"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105", "name": "Jenkins Security Advisory 2023-08-16", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/08/16/3"}], "descriptions": [{"lang": "en", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T12:51:20.506Z"}}}, "cveMetadata": {"cveId": "CVE-2023-40337", "state": "PUBLISHED", "dateUpdated": "2024-10-08T17:52:04.237Z", "dateReserved": "2023-08-14T16:02:56.435Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2023-08-16T14:32:50.031Z", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105 (string)

name : Jenkins Security Advisory 2023-08-16 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2023/08/16/3 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T18:31:53.670Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-40337 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-08T17:51:52.416142Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-08T17:51:59.140Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Jenkins Project (string)

product : Jenkins Folders Plugin (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : maven (string)

lessThanOrEqual : 6.846.v23698686f0f6 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105 (string)

name : Jenkins Security Advisory 2023-08-16 (string)

tags : [ »

0 : vendor-advisory (string)

]

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2023/08/16/3 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder. (string)

}

]

providerMetadata : { »

orgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

shortName : jenkins (string)

dateUpdated : 2023-10-24T12:51:20.506Z (string)

}

cveMetadata : { »

cveId : CVE-2023-40337 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-08T17:52:04.237Z (string)

dateReserved : 2023-08-14T16:02:56.435Z (string)

assignerOrgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

datePublished : 2023-08-16T14:32:50.031Z (string)

assignerShortName : jenkins (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:folders:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "863E381A-42EA-45E2-ACD8-AB6CE13583AF", "versionEndIncluding": "6.846.v23698686f0f6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder."}], "id": "CVE-2023-40337", "lastModified": "2024-11-21T08:19:14.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-16T15:15:11.420", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2023/08/16/3"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2023/08/16/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:jenkins:folders:*:*:*:*:*:jenkins:*:* (string)

matchCriteriaId : 863E381A-42EA-45E2-ACD8-AB6CE13583AF (string)

versionEndIncluding : 6.846.v23698686f0f6 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder. (string)

}

]

id : CVE-2023-40337 (string)

lastModified : 2024-11-21T08:19:14.823 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-08-16T15:15:11.420 (string)

references : [ »

0 : { »

source : jenkinsci-cert@googlegroups.com (string)

tags : [ »

0 : Mailing List (string)

]

url : http://www.openwall.com/lists/oss-security/2023/08/16/3 (string)

}

1 : { »

source : jenkinsci-cert@googlegroups.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

]

url : http://www.openwall.com/lists/oss-security/2023/08/16/3 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105 (string)

}

]

sourceIdentifier : jenkinsci-cert@googlegroups.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-352 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2024:0778", "cpe": "cpe:/a:redhat:ocp_tools:4.12::el8", "package": "jenkins-2-plugins-0:4.12.1706515741-1.el8", "product_name": "OCP-Tools-4.12-RHEL-8", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2024:0777", "cpe": "cpe:/a:redhat:ocp_tools:4.14::el8", "package": "jenkins-2-plugins-0:4.14.1706516441-1.el8", "product_name": "OCP-Tools-4.14-RHEL-8", "release_date": "2024-02-12T00:00:00Z"}], "bugzilla": {"description": "jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin", "id": "2232425", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2232425"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "verified"}, "cwe": "CWE-352", "details": ["A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.", "A flaw was found in the Jenkins Folders plugin. Affected versions of this plugin allow attackers to copy a view inside a folder."], "name": "CVE-2023-40337", "package_state": [{"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Out of support scope", "package_name": "jenkins-2-plugins", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "jenkins-2-plugins", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2023-08-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-40337\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-40337\nhttps://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105"], "threat_severity": "Moderate"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2024:0778 (string)

cpe : cpe:/a:redhat:ocp_tools:4.12::el8 (string)

package : jenkins-2-plugins-0:4.12.1706515741-1.el8 (string)

product_name : OCP-Tools-4.12-RHEL-8 (string)

release_date : 2024-02-12T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2024:0777 (string)

cpe : cpe:/a:redhat:ocp_tools:4.14::el8 (string)

package : jenkins-2-plugins-0:4.14.1706516441-1.el8 (string)

product_name : OCP-Tools-4.14-RHEL-8 (string)

release_date : 2024-02-12T00:00:00Z (string)

}

]

bugzilla : { »

description : jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin (string)

id : 2232425 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2232425 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 4.3 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

status : verified (string)

}

cwe : CWE-352 (string)

details : [ »

0 : A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder. (string)

1 : A flaw was found in the Jenkins Folders plugin. Affected versions of this plugin allow attackers to copy a view inside a folder. (string)

]

name : CVE-2023-40337 (string)

package_state : [ »

0 : { »

cpe : cpe:/a:redhat:openshift:3.11 (string)

fix_state : Out of support scope (string)

package_name : jenkins-2-plugins (string)

product_name : Red Hat OpenShift Container Platform 3.11 (string)

}

1 : { »

cpe : cpe:/a:redhat:openshift:4 (string)

fix_state : Affected (string)

package_name : jenkins-2-plugins (string)

product_name : Red Hat OpenShift Container Platform 4 (string)

}

]

public_date : 2023-08-16T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2023-40337 https://nvd.nist.gov/vuln/detail/CVE-2023-40337 https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105 (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object