Cross-site request forgery in Folders - CVE-2023-40337

Vulnerability identifier: #VU79885

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-40337

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Folders
OpenShift Developer Tools and Services
IBM Cloud Pak for Business Automation
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)

Install updates from vendor's website.

Folders - update to 6.848.ve3b_fd7839a_81
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
jenkins (Red Hat package) - addressed in versions 2.426.3.1706515686-3.el8, 2.426.3.1706516352-3.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 4.12.1706515741-1.el8, 4.14.1706516441-1.el8

• https://jenkins.io/security/advisory/2023-08-16/

• Multiple vulnerabilities in Jenkins Folders plugin
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• OpenShift Developer Tools and Services for OCP 4.14 update for jenkins and jenkins-2-plugins
• OpenShift Developer Tools and Services for OCP 4.12 update for Jenkins and Jenkins-2-plugins