CVE-2023-40338

Medium

Description

Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing information about the Jenkins controller file system.

SeverityMedium

CVSS4.3

Exploit probability—

Product

Jenkins Folders

PublishedAug 16, 2023

First seenAug 16, 2023

How to fix

Update

org.jenkins-ci.plugins:cloudbees-folder6.848.ve3b or later

Vendor advisories

jenkins.io/security/advisory/2023-08-16/#SECURITY-3109

Affected products

Product	Affected versions	Fixed in
jenkins folders	v ≤ 6.846.v23698686f0f6	—
org.jenkins-ci.plugins:cloudbees-folderMaven	v < 6.848.ve3b	6.848.ve3b

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.