Read the docs
TI-2023-21168 Aliases CVE-2023-40339GHSA-pv2g-vm98-vjxf

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e…

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00778 56th percentileScored 2026-11-07
Fix Partial Jenkins Config File Provider Plugin (Jenkins Project): 953.v0432a_802e4d2, 951.953.vdfc5f6e2dcc4org.jenkins-ci.plugins:config-file-provider (Maven): 953.v0432aRed Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Config File Provider Plugin—953.v0432a_802e4d2, 951.953.vdfc5f6e2dcc4Patch availableCNA
—org.jenkins-ci.plugins:config-file-provider (Maven)before 953.v0432a953.v0432aPatch availableGHSA-pv2g-vm98-vjxf
  • Jenkins Config File Provider Plugin VendorJenkins Affected — Fixed in 953.v0432a_802e4d2, 951.953.vdfc5f6e2dcc4 Patch available CNA
  • org.jenkins-ci.plugins:config-file-provider (Maven) Vendor— Affected before 953.v0432a Fixed in 953.v0432a Patch available GHSA-pv2g-vm98-vjxf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*up to 952.va_544a_6234b_46VulnerableJenkins
  • cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:* Versions up to 952.va_544a_6234b_46 Vulnerable ·Jenkins

Remediation

  • Fix · CNA Jenkins Config File Provider Plugin (Jenkins Project) Fixed in 953.v0432a_802e4d2, 951.953.vdfc5f6e2dcc4
  • Fix · GHSA-pv2g-vm98-vjxf org.jenkins-ci.plugins:config-file-provider (Maven) Fixed in 953.v0432a Advisory →

Red Hat 2 advisories

  • RHSA-2024:0778 Released 2024-02-12 · Red Hat rating Important
    Jenkins and Jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1706515741-1.el8, jenkins-2.426.3.1706515686-3.el8
  • RHSA-2024:0777 Released 2024-02-12 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1706516441-1.el8, jenkins-2.426.3.1706516352-3.el8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2024:0778
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2024:0777
Not affected: 2 products
  • OpenShift Developer Tools and Services for OCP 4.12
  • OpenShift Developer Tools and Services for OCP 4.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40339
  2. 2026-10-03 Alias added: GHSA-pv2g-vm98-vjxf

References

Advisory 3

Other 1

  • TI-2021-04722 XML external entity injection in Jenkins Config File Provider Plugin CVSS 3.1HIGH 8.1
  • TI-2018-15887 A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin… CVSS 3.0HIGH 8.1
  • TI-2021-04723 Incorrect authorization in Jenkins Config File Provider Plugin CVSS 3.1MEDIUM 6.5
  • TI-2017-14441 The Config File Provider Plugin is used to centrally manage configuration files that… CVSS 3.0MEDIUM 6.5
  • TI-2021-04724 Cross-site request forgery in Jenkins Config File Provider Plugin CVSS 3.1MEDIUM 5.4
  • TI-2018-15886 A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1… CVSS 3.1MEDIUM 5.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences