GHSA-cj6r-8pxj-5jv6 BIT-jenkins-2023-27902 CVE-2023-27902

Incorrect Permission Preservation in Jenkins Core

Medium Maven

Severity: 4.3 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.74%; Chance of exploitation in the next 30 days. Higher than 54.79% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 2.387.1; Upgrade org.jenkins-ci.main:jenkins-core to this version or later

Description

Jenkins uses temporary directories adjacent to workspace directories, usually with the @tmp name suffix, to store temporary files related to the build. In pipelines, these temporary directories are adjacent to the current working directory when operating in a subdirectory of the automatically allocated workspace. Jenkins-controlled processes, like SCMs, may store credentials in these directories.

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 shows these temporary directories when viewing job workspaces, which allows attackers with Item/Workspace permission to access their contents.

Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 does not list these temporary directories in job workspaces.

As a workaround, do not grant Item/Workspace permission to users who lack Item/Configure permission, if you’re concerned about this issue but unable to immediately update Jenkins.

Affected versions

Maven

Package	Vulnerable	Fixed in
org.jenkins-ci.main:jenkins-core	`>= 2.376, < 2.387.1`	`2.387.1`
org.jenkins-ci.main:jenkins-core	`< 2.375.4`	`2.375.4`
org.jenkins-ci.main:jenkins-core	`>= 2.388, < 2.394`	`2.394`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.jenkins-ci.main:jenkins-core Maven → `2.387.1`

maven

<dependency><groupId>org.jenkins-ci.main</groupId><artifactId>jenkins-core</artifactId><version>2.387.1</version></dependency>

gradle

implementation("org.jenkins-ci.main:jenkins-core:2.387.1")

Severity breakdown

CVSS 3.1 4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2023-27902

Timeline

Mar 10, 2023 Published
Aug 7, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-6f9g-cxwr-q5jr Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE	Critical Known exploited	Also affects org.jenkins-ci.main:jenkins-core
GHSA-8pqx-3rxx-f5pm Jenkins discloses project names via fingerprints	High Known exploited	Also affects org.jenkins-ci.main:jenkins-core
GHSA-26wc-3wqp-g3rp Deserialization of Untrusted Data in Jenkins	Critical Known exploited	Also affects org.jenkins-ci.main:jenkins-core
CVE-2018-1000861 Deserialization of Untrusted Data in Jenkins	Critical Known exploited	Also affects org.jenkins-ci.main:jenkins-core
GHSA-m6wv-wh8g-64xc Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations	Medium	Also affects org.jenkins-ci.main:jenkins-core
GHSA-93qh-vwrm-c5pw Jenkins: Stored XSS vulnerability in node offline cause description	Medium	Also affects org.jenkins-ci.main:jenkins-core
GHSA-92m7-4fpw-2wxm Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"	Medium	Also affects org.jenkins-ci.main:jenkins-core
GHSA-g28p-6mcc-v4rv Jenkins exposes other users' timezone and view names to users with Overall/Read permission	Medium	Also affects org.jenkins-ci.main:jenkins-core

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor