Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-npms-7xaw-mye9
Summary
Jenkins temporary uploaded file created with insecure permissions
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, uploaded files processed via the Stapler web framework and the Jenkins API `MultipartFormDataParser` create temporary files in the system temporary directory with the default permissions for newly created files.

If these permissions are overly permissive, attackers with access to the system temporary directory may be able to read and write the file before it is used.

This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allow attackers to read the temporary file, but not write to it.
Jenkins 2.424, LTS 2.414.2 creates the temporary files in a subdirectory with more restrictive permissions.

As a workaround, you can change your default temporary-file directory using the Java system property `java.io.tmpdir`, if you’re concerned about this issue but unable to immediately update Jenkins.
Aliases
0
alias CVE-2023-43497
1
alias GHSA-qv64-w99c-qcr9
Fixed_packages
0
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.414.2
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.414.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5781-s1ny-q7ey
1
vulnerability VCID-s1wm-h4xx-tfh9
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.414.2
1
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.424
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.424
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.424
Affected_packages
0
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.50
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.50
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4cy9-1z3y-ekba
1
vulnerability VCID-dyka-xcrq-8fds
2
vulnerability VCID-npms-7xaw-mye9
3
vulnerability VCID-s1wm-h4xx-tfh9
4
vulnerability VCID-syz5-rzv5-ukhb
5
vulnerability VCID-vv6x-yj68-cqas
6
vulnerability VCID-yq9y-tdnu-2uc3
7
vulnerability VCID-ytyb-zk5y-6ub2
8
vulnerability VCID-z5ns-74uq-4uef
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.50
1
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.415
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.415
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3vtx-uz1q-vqc6
1
vulnerability VCID-4cy9-1z3y-ekba
2
vulnerability VCID-dyka-xcrq-8fds
3
vulnerability VCID-npms-7xaw-mye9
4
vulnerability VCID-s1wm-h4xx-tfh9
5
vulnerability VCID-vv6x-yj68-cqas
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.415
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-43497.json
reference_id
reference_type
scores
0
value 3.6
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-43497.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-43497
reference_id
reference_type
scores
0
value 0.00089
scoring_system epss
scoring_elements 0.25263
published_at 2026-04-24T12:55:00Z
1
value 0.00089
scoring_system epss
scoring_elements 0.25305
published_at 2026-04-07T12:55:00Z
2
value 0.00089
scoring_system epss
scoring_elements 0.25374
published_at 2026-04-08T12:55:00Z
3
value 0.00089
scoring_system epss
scoring_elements 0.25418
published_at 2026-04-09T12:55:00Z
4
value 0.00089
scoring_system epss
scoring_elements 0.2543
published_at 2026-04-11T12:55:00Z
5
value 0.00089
scoring_system epss
scoring_elements 0.25388
published_at 2026-04-12T12:55:00Z
6
value 0.00089
scoring_system epss
scoring_elements 0.25335
published_at 2026-04-13T12:55:00Z
7
value 0.00089
scoring_system epss
scoring_elements 0.25342
published_at 2026-04-16T12:55:00Z
8
value 0.00089
scoring_system epss
scoring_elements 0.25332
published_at 2026-04-18T12:55:00Z
9
value 0.00089
scoring_system epss
scoring_elements 0.25302
published_at 2026-04-21T12:55:00Z
10
value 0.00089
scoring_system epss
scoring_elements 0.25496
published_at 2026-04-02T12:55:00Z
11
value 0.00089
scoring_system epss
scoring_elements 0.25533
published_at 2026-04-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-43497
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-43497
reference_id
reference_type
scores
0
value 3.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-43497
3
reference_url https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073
reference_id
reference_type
scores
0
value 3.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-24T17:01:04Z/
url https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073
4
reference_url http://www.openwall.com/lists/oss-security/2023/09/20/5
reference_id
reference_type
scores
0
value 3.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-24T17:01:04Z/
url http://www.openwall.com/lists/oss-security/2023/09/20/5
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2240095
reference_id 2240095
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2240095
6
reference_url https://github.com/advisories/GHSA-qv64-w99c-qcr9
reference_id GHSA-qv64-w99c-qcr9
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qv64-w99c-qcr9
Weaknesses
0
cwe_id 434
name Unrestricted Upload of File with Dangerous Type
description The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
1
cwe_id 378
name Creation of Temporary File With Insecure Permissions
description Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
Exploits
Severity_range_score0.1 - 3.6
Exploitability0.5
Weighted_severity3.2
Risk_score1.6
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-npms-7xaw-mye9