Bug 2232425 (CVE-2023-40337)

Summary:	CVE-2023-40337 jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin
Product:	[Other] Security Response	Reporter:	Zack Miele <zmiele>
Component:	vulnerability	Assignee:	Sayan Biswas <sabiswas>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apjagtap, asatyam, dfreiber, diagrawa, ellin, jburrell, rogbas, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Folders Plugin 6.848.ve3b_fd7839a_81	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Jenkins Folders plugin. Affected versions of this plugin allow attackers to copy a view inside a folder.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2232427

Description Zack Miele 2023-08-16 19:48:18 UTC

A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.

https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3105

Comment 3 errata-xmlrpc 2024-02-12 10:25:39 UTC

This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.14

Via RHSA-2024:0777 https://access.redhat.com/errata/RHSA-2024:0777

Comment 4 errata-xmlrpc 2024-02-12 10:37:17 UTC

This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.12

Via RHSA-2024:0778 https://access.redhat.com/errata/RHSA-2024:0778