Jenkins Config File Provider Plugin vulnerabilities

Product

Jenkins Config File Provider Plugin

by Jenkins project · last CVE Aug 16, 2023

CVEs

On KEV

7.5

Max CVSS

New 30D

Severity mix

Critical 0High 1Medium 1Low 0

Severity

Exploitation

Watch

Add Jenkins Config File Provider Plugin to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-40339	7.5	1%	Aug 16	Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written… Affected: All versions, or not specified
CVE-2019-1003014	4.8	1%	Feb 6	An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers… Affected: 3.4.1 and earlier