GHSA-3M3F-2323-64M7 Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints. This allows attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins. Those can be used as part of an...

GHSA-2959-FJ73-HM8P Missing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs

Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate configuration file IDs. An enumeration of configuration file IDs in Jenkins Config File Provider Plugin 3.7.1 require...

org.jenkins-ci.plugins:pipeline-maven (>=0.1-beta, <=0.4), org.jenkins-ci.plugins:pipeline-multibranch-defaults (1.0) potentially affected by CVE-2021-21642 via org.jenkins-ci.plugins:config-file-provider (2.11)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:pipeline-maven =0.1-beta, =0.4 -...

org.jenkinsci.plugins:managed-scripts (1.2.5-beta) potentially affected by CVE-2021-21645 via org.jenkins-ci.plugins:config-file-provider (2.14-beta)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.14-beta is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkinsci.plugins:managed-scripts 1.2.5-beta Source cves:...

org.jenkins-ci.plugins:pipeline-maven (>=0.5, <=2.2.1), org.jenkins-ci.plugins:pipeline-multibranch-defaults (1.1) +1 more potentially affected by CVE-2021-21642 via org.jenkins-ci.plugins:config-file-provider (2.15.1)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:pipeline-maven =0.5, =0.9.0, =0.9.1 Source cves:...

org.jenkins-ci.plugins:ivy (>=1.23, <=1.24) potentially affected by CVE-2021-21645 via org.jenkins-ci.plugins:config-file-provider (2.5)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:ivy =1.23, =1.24 Source cves: CVE-2021-21645 Source...

org.jenkins-ci.plugins:nodejs (>=1.2.5, <=1.2.6) potentially affected by CVE-2021-21645 via org.jenkins-ci.plugins:config-file-provider (2.16.4)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:nodejs =1.2.5, =1.2.6 Source cves: CVE-2021-21645...

org.jenkins-ci.plugins:pipeline-maven (>=2.3.0-beta-1, <=2.5.2) potentially affected by CVE-2021-21643 via org.jenkins-ci.plugins:config-file-provider (2.15.7)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.15.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:pipeline-maven =2.3.0-beta-1, =2.5.2 Source cves:...

org.jenkinsci.plugins:managed-scripts (>=0.0.1, <=0.2.0) potentially affected by CVE-2021-21643 via org.jenkins-ci.plugins:config-file-provider (1.2)

org.jenkins-ci.plugins:config-file-provider MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkinsci.plugins:managed-scripts =0.0.1, =0.2.0 Source cves:...

com.lookout.jenkins:environment-script (1.2.5), org.jenkins-ci.plugins:ivy (>=1.25, <=1.26) +1 more potentially affected by CVE-2021-21643 via org.jenkins-ci.plugins:config-file-provider (2.7.5)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - com.lookout.jenkins:environment-script 1.2.5 - org.jenkins-ci.plugins:ivy...

org.jenkinsci.plugins:managed-scripts (>=0.0.1, <=0.2.0) potentially affected by CVE-2021-21642 via org.jenkins-ci.plugins:config-file-provider (1.2)

org.jenkins-ci.plugins:config-file-provider MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkinsci.plugins:managed-scripts =0.0.1, =0.2.0 Source cves:...

org.jenkins-ci.plugins:jclouds-jenkins (>=2.14, <=2.22) potentially affected by CVE-2021-21645 via org.jenkins-ci.plugins:config-file-provider (2.15.6)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:jclouds-jenkins =2.14, =2.22 Source cves:...

org.jenkins-ci.plugins:jclouds-jenkins (>=2.14, <=2.22) potentially affected by CVE-2021-21642 via org.jenkins-ci.plugins:config-file-provider (2.15.6)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:jclouds-jenkins =2.14, =2.22 Source cves:...

org.jenkins-ci.plugins:nodejs (>=1.0, <=1.2.1) potentially affected by CVE-2021-21642 via org.jenkins-ci.plugins:config-file-provider (2.15.5)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:nodejs =1.0, =1.2.1 Source cves: CVE-2021-21642...

org.jenkins-ci.plugins:pipeline-dependency-walker (1.0.0) potentially affected by CVE-2021-21643 via org.jenkins-ci.plugins:config-file-provider (2.9.3)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:pipeline-dependency-walker 1.0.0 Source cves:...

org.jenkinsci.plugins:managed-scripts (>=0.3, <=1.2.1) potentially affected by CVE-2021-21645 via org.jenkins-ci.plugins:config-file-provider (2.0)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkinsci.plugins:managed-scripts =0.3, =1.2.1 Source cves:...

org.jenkinsci.plugins:managed-scripts (>=0.3, <=1.2.1) potentially affected by CVE-2021-21643 via org.jenkins-ci.plugins:config-file-provider (2.0)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkinsci.plugins:managed-scripts =0.3, =1.2.1 Source cves:...

com.lookout.jenkins:environment-script (1.2.5), org.jenkins-ci.plugins:ivy (>=1.25, <=1.26) +1 more potentially affected by CVE-2021-21645 via org.jenkins-ci.plugins:config-file-provider (2.7.5)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - com.lookout.jenkins:environment-script 1.2.5 - org.jenkins-ci.plugins:ivy...

org.jenkinsci.plugins:managed-scripts (1.4) potentially affected by CVE-2021-21645 via org.jenkins-ci.plugins:config-file-provider (2.16.3)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkinsci.plugins:managed-scripts 1.4 Source cves: CVE-2021-21645...

org.jenkins-ci.plugins:ivy (>=1.27, <=2.2), org.jenkinsci.plugins:managed-scripts (1.3) potentially affected by CVE-2021-21643 via org.jenkins-ci.plugins:config-file-provider (2.15)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:ivy =1.27, =2.2 -...