Jenkins Project Jenkins Config File Provider Plugin vulnerabilities

5 vulnerabilities

Known vulnerabilities in Jenkins Project Jenkins Config File Provider Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3CVE-2021-21645jenkins projectjenkins config file provider plugin+2
EPSS score
0.89%
Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.6.5CVE-2021-21643jenkins projectjenkins config file provider plugin+2
EPSS score
1.08%
Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.5.8CVE-2021-21644jenkins projectjenkins config file provider plugin+2
EPSS score
1.05%
A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.8.1CVE-2021-21642jenkins projectjenkins config file provider plugin+2
EPSS score
37.83%
Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.4.8CVE-2019-1003014jenkins projectjenkins config file provider plugin+3
EPSS score
0.88%
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.