Jenkins Config File Provider
9 CVEs affecting Jenkins Config File Provider. Latest disclosed: 2023-08-16. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21642 | High | 8.1 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2018-1000414 | High | 8.1 | 2019-01-09 | A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction… |
CVE-2023-40339 | High | 7.5 | 2023-08-16 | Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files… |
CVE-2021-21643 | Medium | 6.5 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Jo… |
CVE-2017-1000104 | Medium | 6.5 | 2017-10-05 | The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read acc… |
CVE-2021-21644 | Medium | 5.4 | 2021-04-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corre… |
CVE-2018-1000413 | Medium | 5.4 | 2019-01-09 | A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users w… |
CVE-2019-1003014 | Medium | 4.8 | 2019-02-06 | An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly t… |
CVE-2021-21645 | Medium | 4.3 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to e… |