CVE-2023-27902
Fixed in a distro release EPSS <1%CVSS 4.3
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents.
Products: Jenkins project Jenkins
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.387.1 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.375.4 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.394 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | jenkins | 2.395-r0 |
| Chainguard | jenkins-compat | 2.395-r0 |
| Chainguard | jenkins-remoting | 2.395-r0 |
| Red Hat ocp tools 4.13 | jenkins | 0:2.387.3.1684911776-3.el8 |
| Red Hat ocp tools 4.13 | jenkins-2-plugins | 0:4.13.1684911916-1.el8 |
| Wolfi | jenkins | 2.395-r0 |
| Wolfi | jenkins-compat | 2.395-r0 |
| Wolfi | jenkins-remoting | 2.395-r0 |