Jenkins Config File Provider Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:jenkins_project:jenkins_config_file_provider_plugin:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Jenkins Project (860cd631-1316-551d-89a3-5aa9a0d4f462) |
|---|---|
| Product | Jenkins Config File Provider Plugin (8f2af5c2-7cad-57c5-8e8e-fa01cf26ab5c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-40339 |
not_vulnerable | 2026-06-08 06:09:42.095362 |
Details available
Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.
Published: 2023-08-16T14:32:51.314Z
Updated: 2024-10-08T17:49:36.202Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21645 |
vulnerable | 2026-06-08 05:29:13.071344 |
Details available
Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.
Published: 2021-04-21T14:20:33.000Z
Updated: 2024-08-03T18:16:23.825Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21644 |
vulnerable | 2026-06-08 05:29:13.071018 |
Details available
A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.
Published: 2021-04-21T14:20:31.000Z
Updated: 2024-08-03T18:16:23.701Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21643 |
vulnerable | 2026-06-08 05:29:13.070677 |
Details available
Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.
Published: 2021-04-21T14:20:28.000Z
Updated: 2024-08-03T18:16:23.896Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21642 |
vulnerable | 2026-06-08 05:29:13.069679 |
Details available
Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Published: 2021-04-21T14:20:28.000Z
Updated: 2024-08-03T18:16:23.884Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-1003014 |
vulnerable | 2026-06-08 05:12:21.407282 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.