CVE-2023-35147

CWE-732 — Incorrect Permission Assignment6 documents6 sources
Severity
6.5MEDIUM
EPSS
0.1%
top 68.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins AWS Codecommit Trigger PluginJenkins AWS Codecommit Trigger
Timeline
PublishedJun 14

Description

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

🔴Vulnerability Details

3
CVEList
CVE-2023-35147: Jenkins AWS CodeCommit Trigger Plugin 3↗2023-06-14
▶
GHSA
Arbitrary file read vulnerability in Jenkins AWS CodeCommit Trigger Plugin↗2023-06-14
▶
OSV
Arbitrary file read vulnerability in Jenkins AWS CodeCommit Trigger Plugin↗2023-06-14
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2023-06-14↗2023-06-14
▶
Red Hat
jenkins-2-plugins: aws-codecommit-trigger: Arbitrary file read vulnerability in AWS CodeCommit Trigger Plugin↗2023-06-14
▶