Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-4cy9-1z3y-ekba
Summary
Jenkins temporary uploaded file created with insecure permissions
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, uploaded files processed via the Stapler web framework and the Jenkins API `MultipartFormDataParser` create temporary files in the system temporary directory with the default permissions for newly created files.

If these permissions are overly permissive, attackers with access to the system temporary directory may be able to read and write the file before it is used.

This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allow attackers to read the temporary file, but not write to it.
Jenkins 2.424, LTS 2.414.2 creates the temporary files in a subdirectory with more restrictive permissions.

As a workaround, you can change your default temporary-file directory using the Java system property `java.io.tmpdir`, if you’re concerned about this issue but unable to immediately update Jenkins.
Aliases
0
alias CVE-2023-43498
1
alias GHSA-hq87-h4jg-vxfw
Fixed_packages
0
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.414.2
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.414.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5781-s1ny-q7ey
1
vulnerability VCID-s1wm-h4xx-tfh9
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.414.2
1
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.424
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.424
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.424
Affected_packages
0
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.50
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.50
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4cy9-1z3y-ekba
1
vulnerability VCID-dyka-xcrq-8fds
2
vulnerability VCID-npms-7xaw-mye9
3
vulnerability VCID-s1wm-h4xx-tfh9
4
vulnerability VCID-syz5-rzv5-ukhb
5
vulnerability VCID-vv6x-yj68-cqas
6
vulnerability VCID-yq9y-tdnu-2uc3
7
vulnerability VCID-ytyb-zk5y-6ub2
8
vulnerability VCID-z5ns-74uq-4uef
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.50
1
url pkg:maven/org.jenkins-ci.main/jenkins-core@2.415
purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.415
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3vtx-uz1q-vqc6
1
vulnerability VCID-4cy9-1z3y-ekba
2
vulnerability VCID-dyka-xcrq-8fds
3
vulnerability VCID-npms-7xaw-mye9
4
vulnerability VCID-s1wm-h4xx-tfh9
5
vulnerability VCID-vv6x-yj68-cqas
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.415
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-43498.json
reference_id
reference_type
scores
0
value 3.6
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-43498.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-43498
reference_id
reference_type
scores
0
value 0.00141
scoring_system epss
scoring_elements 0.34276
published_at 2026-04-21T12:55:00Z
1
value 0.00141
scoring_system epss
scoring_elements 0.34315
published_at 2026-04-18T12:55:00Z
2
value 0.00141
scoring_system epss
scoring_elements 0.34328
published_at 2026-04-16T12:55:00Z
3
value 0.00141
scoring_system epss
scoring_elements 0.34356
published_at 2026-04-11T12:55:00Z
4
value 0.00141
scoring_system epss
scoring_elements 0.3428
published_at 2026-04-07T12:55:00Z
5
value 0.00141
scoring_system epss
scoring_elements 0.34323
published_at 2026-04-08T12:55:00Z
6
value 0.00141
scoring_system epss
scoring_elements 0.34354
published_at 2026-04-09T12:55:00Z
7
value 0.00141
scoring_system epss
scoring_elements 0.34385
published_at 2026-04-02T12:55:00Z
8
value 0.00141
scoring_system epss
scoring_elements 0.34292
published_at 2026-04-13T12:55:00Z
9
value 0.00141
scoring_system epss
scoring_elements 0.34316
published_at 2026-04-12T12:55:00Z
10
value 0.00141
scoring_system epss
scoring_elements 0.34413
published_at 2026-04-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-43498
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-43498
reference_id
reference_type
scores
0
value 3.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-43498
3
reference_url https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073
reference_id
reference_type
scores
0
value 3.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-24T18:51:41Z/
url https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073
4
reference_url http://www.openwall.com/lists/oss-security/2023/09/20/5
reference_id
reference_type
scores
0
value 3.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-24T18:51:41Z/
url http://www.openwall.com/lists/oss-security/2023/09/20/5
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2240096
reference_id 2240096
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2240096
6
reference_url https://github.com/advisories/GHSA-hq87-h4jg-vxfw
reference_id GHSA-hq87-h4jg-vxfw
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-hq87-h4jg-vxfw
Weaknesses
0
cwe_id 377
name Insecure Temporary File
description Creating and using insecure temporary files can leave application and system data vulnerable to attack.
1
cwe_id 378
name Creation of Temporary File With Insecure Permissions
description Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
Exploits
Severity_range_score0.1 - 3.6
Exploitability0.5
Weighted_severity3.2
Risk_score1.6
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-4cy9-1z3y-ekba