CVE-2023-40337
Jenkins Folders Plugin cross-site request forgery vulnerability
4.3 MediumFix available
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
0.39%Up 0.3 points since Aug 18, 2023
What each source reports
NVD Score used
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.
- Record
CVE-2023-40337- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.
- Record
CVE-2023-40337- Updated
- 2026-11-02
EUVDEUVD-2023-2180
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.
- Record
EUVD-2023-2180- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-22c3-whjv-hrfm
Jenkins Folders Plugin cross-site request forgery vulnerability
Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to copy a view inside a folder.
Folders Plugin 6.848.ve3b_fd7839a_81 requires POST requests for the affected HTTP endpoint.
- Record
GHSA-22c3-whjv-hrfm- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-22c3-whjv-hrfm
Jenkins Folders Plugin cross-site request forgery vulnerability
Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to copy a view inside a folder.
Folders Plugin 6.848.ve3b_fd7839a_81 requires POST requests for the affected HTTP endpoint.
- Record
GHSA-22c3-whjv-hrfm- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVRHSA-2024:0777
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2024:0777- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:0778
Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update
- Record
RHSA-2024:0778- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:cloudbees-folderMaven |
before 6.848.ve3b | 6.848.ve3b |
org.jenkins-ci.plugins:cloudbees-folderMaven |
before 6.848.ve3b, plus listed versions 4.04.0.14.14.104.11-beta-1 Show 45 moreShow less4.24.2.14.2.24.2.34.34.44.54.64.6.14.74.84.95.05.15.1-beta-15.1-beta-25.105.115.125.135.145.155.165.175.17-beta-15.185.25.2.15.2.25.35.45.55.65.75.85.96.0.06.0.16.0.26.0.36.0.46.1.06.1.16.1.26.10.0 |
6.848.ve3b |
jenkins-2-pluginsRed Hat:ocp_tools:4.14::el8 From an advisory covering 17 CVEs |
before 0:4.14.1706516441-1.el8 | 0:4.14.1706516441-1.el8 |
jenkinsRed Hat:ocp_tools:4.14::el8 From an advisory covering 17 CVEs |
before 0:2.426.3.1706516352-3.el8 | 0:2.426.3.1706516352-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 From an advisory covering 24 CVEs |
before 0:4.12.1706515741-1.el8 | 0:4.12.1706515741-1.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 From an advisory covering 24 CVEs |
before 0:2.426.3.1706515686-3.el8 | 0:2.426.3.1706515686-3.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-40337 is a medium vulnerability (CVSS 4.3) in Jenkins Folders, published August 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in org.jenkins-ci.plugins:cloudbees-folder 6.848.ve3b.
References
jenkins.io/security/advisory/2023-08-16
openwall.com/lists/oss-security/2023/08/16/3
nvd.nist.gov/vuln/detail/CVE-2023-40337
github.com/advisories/GHSA-22c3-whjv-hrfm
access.redhat.com/errata/RHSA-2024:0777
Show 192 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2066479
issues.redhat.com/browse/JKNS-271
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0777.json
cve.org/CVERecord?id=CVE-2022-25857
bitbucket.org/snakeyaml/snakeyaml/issues/525
blogs.apache.org/security/entry/cve-2022-42889
lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
seclists.org/oss-sec/2022/q4/22
go.dev/issue/63417
pkg.go.dev/vuln/GO-2023-2102
cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products
maven.apache.org/docs/3.8.1/release-notes.html
groups.google.com/g/golang-announce/c/nqrv9fbR0zE
spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861
rfc-editor.org/rfc/rfc9110
This page doesn't list everything
Left out here: 38 versions. The JSON record has them.