Not rated
CVE-2021-21645 Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints,…
Description
Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Config File Provider Plugin 3.7 | earliest → 3.7.0 | No fix stated |
Other CVEs of Jenkins Config File Provider Plugin
The 6 CVEs of Jenkins Config File Provider Plugin →
CVE-2023-40339
Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks)…
Not rated
CVE-2021-21644
A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows…
Not rated
CVE-2021-21642
Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity…
Not rated
CVE-2021-21643
Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP…
Not rated