CVE-2023-40336 (High) detected in cloudbees-folder-6.740.ve4f4ffa_dea_54.jar

[mend-for-github-com]

CVE-2023-40336 - High Severity Vulnerability

Vulnerable Library - cloudbees-folder-6.740.ve4f4ffa_dea_54.jar

This plugin allows users to create "folders" to organize jobs. Users can define custom taxonomies (like by project type, organization type etc). Folders are nestable and you can define views within folders. Maintained by CloudBees, Inc.

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/cloudbees-folder/6.740.ve4f4ffa_dea_54/bbf7f4c2fc85179f0c12173a07af4ca188e71566/cloudbees-folder-6.740.ve4f4ffa_dea_54.jar

Dependency Hierarchy:

• ❌ cloudbees-folder-6.740.ve4f4ffa_dea_54.jar (Vulnerable Library)

Found in HEAD commit: c9934b385037128b6444abf6cd7fccd3a7405c2b

Found in base branch: main

Vulnerability Details

A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders.

Publish Date: 2023-08-16

URL: CVE-2023-40336

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-40336

Release Date: 2023-08-16

Fix Resolution: org.jenkins-ci.plugins:cloudbees-folder:6.848.ve3b_fd7839a_81

---

• Check this box to open an automated fix PR

[jordarlu]

even with the latest pipeline-groovy-lib:671.v07c339c842e8 , it will repalce the cloudbees-folder-6.740.ve4f4ffa_dea_54.jar with cloudbees-folder-6.758.vfd75d09eea_a_1.jar, but still vulnerable for same CVEs, and the recommendation will be upgarding to cloudbees-folder:6.848.ve3b_fd7839a_81 which we don't have the fix in pipeline-groovy-lib yet as of today .. will need to wait for newer version of pipeline-groovy-lib

[gaiksaya]

Duplicate of #3902

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[krisfreedain]

@gaiksaya - can you look at this?

Catch All Triage - 1, 2, 3

[gaiksaya]

Duplicate of #3902