CF
Product
Config File Provider
9
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 6Low 0
Watch
Add Config File Provider to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-21643 | 6.5 | Apr 21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure… Affected: through 3.7.0 |
| CVE-2017-1000104 | 6.5 | Oct 5 | The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords Affected: through 2.16.1 |
| CVE-2021-21644 | 5.4 | Apr 21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an… Affected: through 3.7.0 |
| CVE-2018-1000413 | 5.4 | Jan 9 | A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to… Affected: through 3.1 |
| CVE-2019-1003014 | 4.8 | Feb 6 | An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers… Affected: through 3.4.1 |
| CVE-2021-21645 | 4.3 | Apr 21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate… Affected: through 3.7.0 |
Showing 6