CVE-2017-1000104 Improper Privilege Management in Jenkins Config File Provider Plugin
Users with read-only access could view sensitive configuration files containing secrets due to missing authorization checks in the Config File Provider Plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000104?
CVE-2017-1000104 is a medium-severity missing authorization vulnerability in n/a, published on 4 Oct 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read access to Jenkins were able to access URLs directly that allowed viewing these files. Access to view these files now requires sufficient permissions to configure the provided files, view the configuration of the folder in which the configuration files are defined, or have Job/Configure permissions to a job able to use these files.
Weakness: CWE-269
Which versions are affected by CVE-2017-1000104?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:config-file-provider. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:config-file-provider Maven | All versions | 2.16.2 |
org.jenkins-ci.plugins:config-file-provider Maven | All versions | 2.16.2 |
Products include Jenkins Config File Provider.
How do I fix CVE-2017-1000104?
Upgrade org.jenkins-ci.plugins:config-file-provider to 2.16.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-1000104 being exploited?
There is no known exploitation of CVE-2017-1000104 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-21642 XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin
- CVE-2018-1000414 CSRF vulnerability in Config File Provider Plugin
- CVE-2023-40339 Jenkins Config File Provider Plugin improper credential masking vulnerability
- CVE-2021-21643 Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs
- CVE-2021-21644 CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files
Sources
Also known as GHSA-6h72-m3xw-fp3c.