CVE-2023-40338
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available.
Risk Assessment
The exposure of the absolute path to the log file may lead to the disclosure of information about the Jenkins controller file system, increasing the risk of attacks on the infrastructure.
Recommendation
It is recommended to update the Jenkins Folders Plugin to the latest version to minimize the risk of information disclosure.
Other vulnerabilities in Jenkins Folders Plugin
See all- CVE-2023-40337Medium
The Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to copy a view inside a folder.
- CVE-2023-40336High
The Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to copy folders.
Original NVD description (English source)
Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing information about the Jenkins controller file system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS