CVE-2023-41930
Path traversal in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.
- Record
CVE-2023-41930- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE ListNo score
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.
- Record
CVE-2023-41930- Updated
- 2026-11-02
EUVDEUVD-2023-2487
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.
- Record
EUVD-2023-2487- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c7r5-cww9-64q6
Path traversal in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.
- Record
GHSA-c7r5-cww9-64q6- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-c7r5-cww9-64q6
Path traversal in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.
- Record
GHSA-c7r5-cww9-64q6- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:jobConfigHistoryMaven | through 1227.v7a | 1229.v3039470161a_d |
org.jenkins-ci.plugins:jobConfigHistoryMaven | before 1229.v3039470161a_d, plus listed versions 1.101.111.121.131119.v509e1017356b_ Show 45 moreShow less1133.v0f5420f850531139.v888b_656ca_f6d1146.v94c2521f92131148.v8607da_ef251e1155.v28a_46a_cc06a_51156.v536a_97b_8d6491163.ve82c7c6e60a_31165.v8cc9fd1f45971166.vc9f255f45b_8a1170.v8a_c085b_dd49c1171.v04b_66d78555e1176.v1b_4290db_41a_51183.v6e2785ff75e01187.v2a_b_1ca_54d18d1191.v168c8c2b_956a1198.v4d5736c2308c1206.vc8967cc8a_2cb_1207.vd28a_54732f921212.vd4470d08ff121227.v7a_79fc4dc01f2.02.12.1.12.102.112.122.132.142.152.162.172.182.18.12.18.22.18.32.192.22.202.212.222.232.23.12.242.252.26 | 1229.v3039470161a_d |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41930 is a medium vulnerability (CVSS 4.3) in Jenkins Job Configuration History, published September 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in org.jenkins-ci.plugins:jobConfigHistory 1229.v3039470161a_d.
References
Left out here: 16 versions. The JSON record has them.