Medium severity6.5NVD Advisory· Published Oct 5, 2017· Updated Jun 17, 2026
CVE-2017-1000104
CVE-2017-1000104
Description
The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read access to Jenkins were able to access URLs directly that allowed viewing these files. Access to view these files now requires sufficient permissions to configure the provided files, view the configuration of the folder in which the configuration files are defined, or have Job/Configure permissions to a job able to use these files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:config-file-providerMaven | < 2.16.2 | 2.16.2 |
Affected products
2- cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*Range: <=2.16.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-6h72-m3xw-fp3cghsaADVISORY
- jenkins.io/security/advisory/2017-08-07/nvdVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2017-1000104ghsaADVISORY
- jenkins.io/security/advisory/2017-08-07ghsaWEB
News mentions
0No linked articles in our index yet.