CVE-2023-40339

Jenkins Config File Provider Plugin improper credential masking vulnerability

7.5 HighFix available

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.78%Up 0.7 points since Aug 18, 2023

What each source reports

NVD Score used 7.5

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.

Record: CVE-2023-40339
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

CVE List No score

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.

Record: CVE-2023-40339
Updated: 2026-11-02

EUVDEUVD-2023-2333 0.0

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.

Record: EUVD-2023-2333
CVSS: 0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pv2g-vm98-vjxf 4.3

Jenkins Config File Provider Plugin improper credential masking vulnerability

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they’re written to the build log.

Config File Provider Plugin 953.v0432a_802e4d2 masks credentials configured in configuration files if they appear in the build log.

Record: GHSA-pv2g-vm98-vjxf
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSV 7.5

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.

Record: CVE-2023-40339
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-pv2g-vm98-vjxf 4.3

Jenkins Config File Provider Plugin improper credential masking vulnerability

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they’re written to the build log.

Config File Provider Plugin 953.v0432a_802e4d2 masks credentials configured in configuration files if they appear in the build log.

Record: GHSA-pv2g-vm98-vjxf
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2024:0777 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record: RHSA-2024:0777
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:0778 9.8

Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update

Record: RHSA-2024:0778
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.plugins:config-file-provider` Maven	before 953.v0432a	953.v0432a
`org.jenkins-ci.plugins:config-file-provider` Maven	before 953.v0432a, plus listed versions 1.01.11.21.51.6.1 Show 45 moreShow less 1.9.12.02.12.1.12.10.02.10.12.112.132.14-beta2.14.1-beta2.14.2-beta2.152.15.12.15.2-beta2.15.32.15.3-beta2.15.42.15.52.15.62.15.72.16.02.16.12.16.22.16.32.16.42.172.182.2.12.32.42.52.5.12.62.6.12.6.22.72.7.12.7.42.7.52.8.12.9.22.9.33.03.13.10.0	953.v0432a
`jenkins-2-plugins` Red Hat:ocp_tools:4.14::el8 From an advisory covering 17 CVEs	before 0:4.14.1706516441-1.el8	0:4.14.1706516441-1.el8
`jenkins` Red Hat:ocp_tools:4.14::el8 From an advisory covering 17 CVEs	before 0:2.426.3.1706516352-3.el8	0:2.426.3.1706516352-3.el8
`jenkins-2-plugins` Red Hat:ocp_tools:4.12::el8 From an advisory covering 24 CVEs	before 0:4.12.1706515741-1.el8	0:4.12.1706515741-1.el8
`jenkins` Red Hat:ocp_tools:4.12::el8 From an advisory covering 24 CVEs	before 0:2.426.3.1706515686-3.el8	0:2.426.3.1706515686-3.el8

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-40339 is a high vulnerability (CVSS 7.5) in Jenkins Config File Provider, published August 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in org.jenkins-ci.plugins:config-file-provider 953.v0432a.

References

Show 193 moreShow less

This page doesn't list everything

Left out here: 21 versions. The JSON record has them.