GCVE - cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Config File Provider (`1b2a01a2-7a8b-57ad-b616-9a107b350110`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-40339`	vulnerable	2026-06-08 06:09:42.096220	Details available Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log. Published: 2023-08-16T14:32:51.314Z Updated: 2024-10-08T17:49:36.202Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3090 http://www.openwall.com/lists/oss-security/2023/08/16/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21645`	vulnerable	2026-06-08 05:29:13.071373	Details available Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs. Published: 2021-04-21T14:20:33.000Z Updated: 2024-08-03T18:16:23.825Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2203 http://www.openwall.com/lists/oss-security/2021/04/21/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21644`	vulnerable	2026-06-08 05:29:13.071050	Details available A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID. Published: 2021-04-21T14:20:31.000Z Updated: 2024-08-03T18:16:23.701Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2202 http://www.openwall.com/lists/oss-security/2021/04/21/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21643`	vulnerable	2026-06-08 05:29:13.070716	Details available Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins. Published: 2021-04-21T14:20:28.000Z Updated: 2024-08-03T18:16:23.896Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254 http://www.openwall.com/lists/oss-security/2021/04/21/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21642`	vulnerable	2026-06-08 05:29:13.070309	Details available Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Published: 2021-04-21T14:20:28.000Z Updated: 2024-08-03T18:16:23.884Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2204 http://www.openwall.com/lists/oss-security/2021/04/21/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-1003014`	vulnerable	2026-06-08 05:12:21.407828	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000414`	vulnerable	2026-06-08 05:10:25.687111	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000413`	vulnerable	2026-06-08 05:10:25.686714	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-1000104`	vulnerable	2026-06-08 05:08:33.998545	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.