jordarlu
commented
11 months ago even with the latest pipeline-groovy-lib:671.v07c339c842e8 , it will repalce the cloudbees-folder-6.740.ve4f4ffa_dea_54.jar with cloudbees-folder-6.758.vfd75d09eea_a_1.jar, but still vulnerable for same CVEs, and the recommendation will be upgarding to cloudbees-folder:6.848.ve3b_fd7839a_81 which we don't have the fix in pipeline-groovy-lib yet as of today .. will need to wait for newer version of pipeline-groovy-lib
CVE-2023-40337 - Medium Severity Vulnerability
This plugin allows users to create "folders" to organize jobs. Users can define custom taxonomies (like by project type, organization type etc). Folders are nestable and you can define views within folders. Maintained by CloudBees, Inc.
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/cloudbees-folder/6.740.ve4f4ffa_dea_54/bbf7f4c2fc85179f0c12173a07af4ca188e71566/cloudbees-folder-6.740.ve4f4ffa_dea_54.jar
Dependency Hierarchy: - :x: **cloudbees-folder-6.740.ve4f4ffa_dea_54.jar** (Vulnerable Library)
Found in HEAD commit: b439dcbcaec85cb505ff1870eaac296568ab9261
Found in base branch: main
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.
Publish Date: 2023-08-16
URL: CVE-2023-40337
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-40337
Release Date: 2023-08-16
Fix Resolution: org.jenkins-ci.plugins:cloudbees-folder:6.848.ve3b_fd7839a_81