CVE-2023-43497

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.

• CWE-434

• http://www.openwall.com/lists/oss-security/2023/09/20/5Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/09/20/5Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073Vendor Advisory

Published

Sep 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43491An information disclosure vulnerability exists in the web in…7.5
• CVE-2023-43492 In Weintek's cMT3000 HMI Web CGI device, the cgi-bi…9.8
• CVE-2023-43493SQL injection vulnerability in Item List page of Welcart e-C…4.9
• CVE-2023-43494Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 thro…4.3
• CVE-2023-43495Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not …5.4
• CVE-2023-43496Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a…8.8
• CVE-2023-43498In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, proce…8.1
• CVE-2023-43499Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does…5.4
• CVE-2023-4350Inappropriate implementation in Fullscreen in Google Chrome …6.5
• CVE-2023-43500A cross-site request forgery (CSRF) vulnerability in Jenkins…8.8
• CVE-2023-43501A missing permission check in Jenkins Build Failure Analyzer…6.5
• CVE-2023-43502A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3