CVE-2023-32986
Published: 16 May 2023
Summary
CVE-2023-32986 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Jenkins File Parameters. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 14.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier contains an improper access control flaw tracked as CWE-732. The plugin fails to restrict the name, and therefore the resulting uploaded file name, of Stashed File Parameters, which permits arbitrary file creation or replacement on the Jenkins controller file system.
Attackers who possess Item/Configure permission can exploit the issue remotely without user interaction. Successful exploitation allows them to write attacker-controlled content to any location on the controller file system, resulting in high impact to confidentiality, integrity, and availability as reflected in the CVSS 8.8 score.
The Jenkins security advisory published on 2023-05-16 under SECURITY-3123 addresses the vulnerability and is available at the referenced URL.
EPSS for the CVE rose from a low baseline to a peak of 0.1112 on 2026-04-30 before receding to the current value of 0.0253.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1464
Vulnerability details
Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified…
more
content.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Procedures support proper permission assignment for critical resources through documented controls.
Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.
Prevents overly permissive assignments to critical resources by limiting to task needs.
Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.
Training on permission management reduces incorrect permission assignments for critical resources.
Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.
Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.
Certification includes checking that permissions on critical resources are correctly assigned.