What is the vulnerability ID for this Jenkins Job Configuration History Plugin vulnerability?

The vulnerability ID is CVE-2023-41932.

What is the severity of CVE-2023-41932?

The severity of CVE-2023-41932 is medium with a severity value of 6.5.

What is the affected software version for CVE-2023-41932?

The affected software version is Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier.

Are there any references for this vulnerability?

Yes, you can find references for this vulnerability [here](http://www.openwall.com/lists/oss-security/2023/09/06/9) and [here](https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235).

Vulnerability/
CVE-2023-41932

medium

6.5

CWE

611

6/9/2023

26/9/2024

CVE-2023-41932: XEE

Q: What does the Jenkins Job Configuration History Plugin vulnerability allow attackers to do?

The vulnerability allows attackers to delete attacker-specified directories on the Jenkins controller file system, as long as they contain a file called 'history.xml'.

First published: Wed Sep 06 2023(Updated: )

Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.

Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com

Affected Software	Affected Version	How to fix
Jenkins Job Configuration History	<=1227.v7a_79fc4dc01f
maven/org.jenkins-ci.plugins:jobConfigHistory	<=1227.v7a	1229.v3039470161a_d

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability ID for this Jenkins Job Configuration History Plugin vulnerability?
The vulnerability ID is CVE-2023-41932.
What is the severity of CVE-2023-41932?
The severity of CVE-2023-41932 is medium with a severity value of 6.5.
What does the Jenkins Job Configuration History Plugin vulnerability allow attackers to do?
The vulnerability allows attackers to delete attacker-specified directories on the Jenkins controller file system, as long as they contain a file called 'history.xml'.
What is the affected software version for CVE-2023-41932?
The affected software version is Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier.
Are there any references for this vulnerability?
Yes, you can find references for this vulnerability [here](http://www.openwall.com/lists/oss-security/2023/09/06/9) and [here](https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235).

collector/nvd-api
collector/nvd-index
agent/type
agent/first-publish-date
collector/github-advisory-latest
source/GitHub
alias/GHSA-cgh7-rgqg-hrcx
alias/CVE-2023-41932
agent/software-canonical-lookup
agent/author
agent/severity
agent/references
agent/weakness
agent/last-modified-date
agent/description
collector/nvd-cve
source/NVD
agent/softwarecombine
agent/event
collector/github-advisory
agent/tags
collector/mitre-cve
source/MITRE
vendor/jenkins
canonical/jenkins job configuration history
version/jenkins job configuration history/1227.v7a_79fc4dc01f
package-manager/maven

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.