CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2023-35147
Medium (6.5) in jenkins aws codecommit trigger. EPSS 0.6% chance of exploitation in the next 30 days.
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWE
- CWE-732
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:aws_codecommit_trigger
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-whgj-6m78-2gg9 | Maven | org.jenkins-ci.plugins:aws-codecommit-trigger | <=3.0.12 | no fix published |