CVE-2023-40336
Jenkins Folders Plugin cross-site request forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders.
- Record
CVE-2023-40336- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders.
- Record
CVE-2023-40336- Updated
- 2026-11-02
EUVDEUVD-2023-2208
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders.
- Record
EUVD-2023-2208- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4vqp-pcm3-73xp
Jenkins Folders Plugin cross-site request forgery vulnerability
Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to copy an item, which could potentially automatically approve unsandboxed scripts and allow the execution of unsafe scripts.
Folders Plugin 6.848.ve3b_fd7839a_81 requires POST requests for the affected HTTP endpoint.
- Record
GHSA-4vqp-pcm3-73xp- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-4vqp-pcm3-73xp
Jenkins Folders Plugin cross-site request forgery vulnerability
Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to copy an item, which could potentially automatically approve unsandboxed scripts and allow the execution of unsafe scripts.
Folders Plugin 6.848.ve3b_fd7839a_81 requires POST requests for the affected HTTP endpoint.
- Record
GHSA-4vqp-pcm3-73xp- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVRHSA-2024:0777
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2024:0777- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:cloudbees-folderMaven |
before 6.848.ve3b | 6.848.ve3b |
org.jenkins-ci.plugins:cloudbees-folderMaven |
before 6.848.ve3b, plus listed versions 4.04.0.14.14.104.11-beta-1 Show 45 moreShow less4.24.2.14.2.24.2.34.34.44.54.64.6.14.74.84.95.05.15.1-beta-15.1-beta-25.105.115.125.135.145.155.165.175.17-beta-15.185.25.2.15.2.25.35.45.55.65.75.85.96.0.06.0.16.0.26.0.36.0.46.1.06.1.16.1.26.10.0 |
6.848.ve3b |
jenkins-2-pluginsRed Hat:ocp_tools:4.14::el8 From an advisory covering 17 CVEs |
before 0:4.14.1706516441-1.el8 | 0:4.14.1706516441-1.el8 |
jenkinsRed Hat:ocp_tools:4.14::el8 From an advisory covering 17 CVEs |
before 0:2.426.3.1706516352-3.el8 | 0:2.426.3.1706516352-3.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-40336 is a high vulnerability (CVSS 8.8) in Jenkins Folders, published August 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in org.jenkins-ci.plugins:cloudbees-folder 6.848.ve3b.
References
jenkins.io/security/advisory/2023-08-16
openwall.com/lists/oss-security/2023/08/16/3
nvd.nist.gov/vuln/detail/CVE-2023-40336
github.com/advisories/GHSA-4vqp-pcm3-73xp
access.redhat.com/errata/RHSA-2024:0777
Show 111 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2066479
issues.redhat.com/browse/JKNS-271
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0777.json
cve.org/CVERecord?id=CVE-2022-25857
bitbucket.org/snakeyaml/snakeyaml/issues/525
blogs.apache.org/security/entry/cve-2022-42889
lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
seclists.org/oss-sec/2022/q4/22
go.dev/issue/63417
pkg.go.dev/vuln/GO-2023-2102
cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products
Left out here: 38 versions. The JSON record has them.