GCVE - cpe:2.3:a:jenkins:s3_publisher:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:s3_publisher:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	S3 Publisher (`bedc37c5-c152-5314-ae84-d738e7daae3b`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-21651`	vulnerable	2026-06-08 05:29:13.081738	Details available Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles. Published: 2021-05-11T14:15:22.000Z Updated: 2024-08-03T18:23:27.398Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2201	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21650`	vulnerable	2026-06-08 05:29:13.081360	Details available Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled. Published: 2021-05-11T14:15:21.000Z Updated: 2024-08-03T18:23:27.382Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2200	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-2114`	vulnerable	2026-06-08 05:24:58.918571	Details available Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. Published: 2020-02-12T14:35:42.000Z Updated: 2024-08-04T07:01:40.926Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1684 http://www.openwall.com/lists/oss-security/2020/02/12/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000177`	vulnerable	2026-06-08 05:10:25.584277	Details available A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions. Published: 2018-05-08T15:00:00.000Z Updated: 2024-09-17T04:20:43.246Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2018-04-16/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.