Medium severity6.5NVD Advisory· Published Oct 5, 2017· Updated May 13, 2026
CVE-2017-1000104
CVE-2017-1000104
Description
The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read access to Jenkins were able to access URLs directly that allowed viewing these files. Access to view these files now requires sufficient permissions to configure the provided files, view the configuration of the folder in which the configuration files are defined, or have Job/Configure permissions to a job able to use these files.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:config-file-providerMaven | < 2.16.2 | 2.16.2 |
Affected products
1- cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*Range: <=2.16.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-6h72-m3xw-fp3cghsaADVISORY
- jenkins.io/security/advisory/2017-08-07/nvdVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2017-1000104ghsaADVISORY
- jenkins.io/security/advisory/2017-08-07ghsaWEB
News mentions
0No linked articles in our index yet.