GCVE - cpe:2.3:a:jenkins:job_import:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:job_import:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Job Import (`55168cb2-23b7-572c-9240-9c4fd1a925d5`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/jenkinsci/job-import-plugin`	purl2cpe	2026-06-01 10:14:09.559350

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-43413`	vulnerable	2026-06-08 05:49:31.801017	Details available Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Published: 2022-10-19T00:00:00.000Z Updated: 2025-05-08T19:17:17.738Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2791 http://www.openwall.com/lists/oss-security/2022/10/19/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-1003017`	vulnerable	2026-06-08 05:12:21.411028	Details available A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration. Published: 2019-02-06T16:00:00.000Z Updated: 2024-09-17T02:26:18.483Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1302	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-1003016`	vulnerable	2026-06-08 05:12:21.410731	Details available An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Published: 2019-02-06T16:00:00.000Z Updated: 2024-09-16T17:15:19.836Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20%282%29	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-1003015`	vulnerable	2026-06-08 05:12:21.410343	Details available An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried in preparation of job import to read arbitrary files, perform a denial of service attack, etc. Published: 2019-02-06T16:00:00.000Z Updated: 2024-09-16T18:49:29.812Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20%281%29	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.