CVE-2023-41932
Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
- Record
CVE-2023-41932- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE ListNo score
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
- Record
CVE-2023-41932- Updated
- 2026-11-02
EUVDEUVD-2023-2488
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
- Record
EUVD-2023-2488- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cgh7-rgqg-hrcx
Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
- Record
GHSA-cgh7-rgqg-hrcx- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-cgh7-rgqg-hrcx
Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
- Record
GHSA-cgh7-rgqg-hrcx- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:jobConfigHistoryMaven | through 1227.v7a | 1229.v3039470161a_d |
org.jenkins-ci.plugins:jobConfigHistoryMaven | before 1229.v3039470161a_d, plus listed versions 1.101.111.121.131119.v509e1017356b_ Show 45 moreShow less1133.v0f5420f850531139.v888b_656ca_f6d1146.v94c2521f92131148.v8607da_ef251e1155.v28a_46a_cc06a_51156.v536a_97b_8d6491163.ve82c7c6e60a_31165.v8cc9fd1f45971166.vc9f255f45b_8a1170.v8a_c085b_dd49c1171.v04b_66d78555e1176.v1b_4290db_41a_51183.v6e2785ff75e01187.v2a_b_1ca_54d18d1191.v168c8c2b_956a1198.v4d5736c2308c1206.vc8967cc8a_2cb_1207.vd28a_54732f921212.vd4470d08ff121227.v7a_79fc4dc01f2.02.12.1.12.102.112.122.132.142.152.162.172.182.18.12.18.22.18.32.192.22.202.212.222.232.23.12.242.252.26 | 1229.v3039470161a_d |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41932 is a medium vulnerability (CVSS 6.5) in Jenkins Job Configuration History, published September 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in org.jenkins-ci.plugins:jobConfigHistory 1229.v3039470161a_d.
References
Left out here: 16 versions. The JSON record has them.