Config File Provider vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

CF

Product

Config File Provider

by Jenkins · last CVE Aug 16, 2023

9

CVEs

0

On KEV

8.1

Max CVSS

0

New 30D

Vulnerabilities9 In the news0 Timeline

Severity mix

Critical 0High 3Medium 6Low 0

Severity

All severities9 Critical0 High3 Medium6 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Config File Provider to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-21642	8.1	38%	Apr 21	Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks Affected: through 3.7.0
CVE-2018-1000414	8.1	1%	Jan 9	A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows… Affected: through 3.1
CVE-2023-40339	7.5	1%	Aug 16	Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written… Affected: through 952.va_544a_6234b_46
CVE-2021-21643	6.5	1%	Apr 21	Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure… Affected: through 3.7.0
CVE-2017-1000104	6.5	1%	Oct 5	The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords Affected: through 2.16.1
CVE-2021-21644	5.4	1%	Apr 21	A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an… Affected: through 3.7.0
CVE-2018-1000413	5.4	1%	Jan 9	A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to… Affected: through 3.1
CVE-2019-1003014	4.8	1%	Feb 6	An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers… Affected: through 3.4.1
CVE-2021-21645	4.3	1%	Apr 21	Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate… Affected: through 3.7.0