Jenkins Project Jenkins Job Configuration History Plugin vulnerabilities
8 vulnerabilities
Known vulnerabilities in Jenkins Project Jenkins Job Configuration History Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-36887jenkins projectjenkins job configuration history plugin+2
EPSS score0.41%
A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.CVE-2022-38664jenkins projectjenkins job configuration history plugin+2EPSS score0.71%
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.CVE-2026-84666jenkins projectjenkins job configuration history pluginEPSS score0.14%
Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.CVE-2026-57287jenkins projectjenkins job configuration history plugin+2EPSS score0.19%
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.CVE-2023-41931jenkins projectjenkins job configuration history plugin+2EPSS score0.50%
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.CVE-2023-41932jenkins projectjenkins job configuration history plugin+2EPSS score0.67%
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.CVE-2023-41933jenkins projectjenkins job configuration history plugin+2EPSS score0.91%
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2023-41930jenkins projectjenkins job configuration history plugin+2EPSS score0.92%
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.