« Volver al listado

CVE-2023-50764

Estado: ModificadaAlta (8.1)—

Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jenkins — Scriptler

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-50764",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "affectedData": [
        {
          "vendor": "Jenkins Project",
          "product": "Jenkins Scriptler Plugin",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "maven",
              "lessThanOrEqual": "342.v6a_89fd40f466"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-13T18:15:43.737",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2023/12/13/4",
      "tags": [
        "Mailing List"
      ],
      "source": "jenkinsci-cert@googlegroups.com"
    },
    {
      "url": "https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3205",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "jenkinsci-cert@googlegroups.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2023/12/13/4",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3205",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system."
    },
    {
      "lang": "es",
      "value": "El complemento Jenkins Scriptler 342.v6a_89fd40f466 y anteriores no restringe un parámetro de consulta de nombre de archivo en un endpoint HTTP, lo que permite a atacantes con permiso Scriptler/Configure eliminar archivos arbitrarios en el sistema de archivos del controlador Jenkins."
    }
  ],
  "lastModified": "2026-06-17T06:39:55.893",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:scriptler:*:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1893B161-24C0-44C0-A7C7-15EA4B0485A6",
              "versionEndIncluding": "342.v6a_89fd40f466"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "jenkinsci-cert@googlegroups.com"
}