CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2023-27901
High (7.5) in jenkins jenkins. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.375.4, 2.387.1, 2.394.
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:jenkins
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h76p-mc68-jv3p | Maven | org.jenkins-ci.main:jenkins-core | >=2.388 <2.394 | 2.394 |
| GHSA-h76p-mc68-jv3p | Maven | org.jenkins-ci.main:jenkins-core | <2.375.4 | 2.375.4 |
| GHSA-h76p-mc68-jv3p | Maven | org.jenkins-ci.main:jenkins-core | >=2.376 <2.387.1 | 2.387.1 |