Jenkins temporary plugin file created with insecure permissions
Jenkins creates a temporary file when a plugin is deployed directly from a URL.
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates this temporary file in the system temporary directory with the default permissions for newly created files.
If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.
This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allow attackers to read the temporary file, but not write to it.
This issue complements SECURITY-2823, which affected plugins uploaded from an administrator’s computer. Jenkins 2.424, LTS 2.414.2 creates the temporary file in a subdirectory with more restrictive permissions.
As a workaround, you can change your default temporary-file directory using the Java system property java.io.tmpdir, if you’re concerned about this issue but unable to immediately update Jenkins.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | org.jenkins-ci.main:jenkins-core | >= 2.50, < 2.414.2, >= 2.415, < 2.424 | 2.414.2, 2.424 |
Referencias
- Vector CVSS
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-276- Plataforma
- Java / Kotlin (Maven)
- Paquete
org.jenkins-ci.main:jenkins-core- Publicada
- 20.09.2023
- Actualizado
- 11.10.2026 12:21
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-55wp-3pq4-w8p9 - CC BY 4.0
Historial de vulnerabilidades: org.jenkins-ci.main:jenkins-core
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 259
- Primera → última
- 01.2022 06.2026
- Sin corrección
- 1
- Explotada en ataques
- 4
Distribución por gravedad
- Crítica 19
- Alta 62
- Media 158
- Baja 20
Divulgaciones por año
- 2022: 213
- 2023: 14
- 2024: 6
- 2025: 14
- 2026: 12
-
Jenkins temporary plugin file created with insecure permissions esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.