1. Home
  2. CVE Database
  3. CVE-2023-24455
MEDIUM · 4.3

CVE-2023-24455

Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence o...

Vulnerability Description

Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
JenkinsVisual Expert1.0

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2023-24455?

CVE-2023-24455 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence o...

How severe is CVE-2023-24455?

CVE-2023-24455 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-24455?

Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Visual Expert.