Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they’re written to the build log.

Config File Provider Plugin 953.v0432a_802e4d2 masks credentials configured in configuration files if they appear in the build log.

Affected Packages

Maven org.jenkins-ci.plugins:config-file-provider

Affected versions: 0 (fixed in 953.v0432a)

Related CVEs

CVE-2023-40339

Key Information

GHSA ID

GHSA-pv2g-vm98-vjxf

Published

August 16, 2023 3:30 PM

Last Modified

January 5, 2024 3:11 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:config-file-provider

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 6, 2025 6:30 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.