CVE-2023-40337 (Medium) detected in cloudbees-folder-6.740.ve4f4ffa_dea_54.jar

[mend-for-github-com]

CVE-2023-40337 - Medium Severity Vulnerability

Vulnerable Library - cloudbees-folder-6.740.ve4f4ffa_dea_54.jar

This plugin allows users to create "folders" to organize jobs. Users can define custom taxonomies (like by project type, organization type etc). Folders are nestable and you can define views within folders. Maintained by CloudBees, Inc.

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/cloudbees-folder/6.740.ve4f4ffa_dea_54/bbf7f4c2fc85179f0c12173a07af4ca188e71566/cloudbees-folder-6.740.ve4f4ffa_dea_54.jar

Dependency Hierarchy:

• ❌ cloudbees-folder-6.740.ve4f4ffa_dea_54.jar (Vulnerable Library)

Found in HEAD commit: b439dcbcaec85cb505ff1870eaac296568ab9261

Found in base branch: main

Vulnerability Details

A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.

Publish Date: 2023-08-16

URL: CVE-2023-40337

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-40337

Release Date: 2023-08-16

Fix Resolution: org.jenkins-ci.plugins:cloudbees-folder:6.848.ve3b_fd7839a_81

---

• Check this box to open an automated fix PR

[jordarlu]

even with the latest pipeline-groovy-lib:671.v07c339c842e8 , it will repalce the cloudbees-folder-6.740.ve4f4ffa_dea_54.jar with cloudbees-folder-6.758.vfd75d09eea_a_1.jar, but still vulnerable for same CVEs, and the recommendation will be upgarding to cloudbees-folder:6.848.ve3b_fd7839a_81 which we don't have the fix in pipeline-groovy-lib yet as of today .. will need to wait for newer version of pipeline-groovy-lib