{"id":"CVE-2023-41932","aliases":["EUVD-2023-2488","GHSA-cgh7-rgqg-hrcx"],"status":"published","title":"Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin","description":"Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0067,"percentile":0.52442,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2023-09-06T12:08:53Z","modified":"2026-06-17T06:23:05Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:jobConfigHistory","fixed_in":["1229.v3039470161a_d"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:jobConfigHistory","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1227.v7a"},{"fixed":"1229.v3039470161a_d"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:jobConfigHistory","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1229.v3039470161a_d"}]}],"versions":["1.10","1.11","1.12","1.13","1119.v509e1017356b_","1133.v0f5420f85053","1139.v888b_656ca_f6d","1146.v94c2521f9213","1148.v8607da_ef251e","1155.v28a_46a_cc06a_5","1156.v536a_97b_8d649","1163.ve82c7c6e60a_3","1165.v8cc9fd1f4597","1166.vc9f255f45b_8a","1170.v8a_c085b_dd49c","1171.v04b_66d78555e","1176.v1b_4290db_41a_5","1183.v6e2785ff75e0","1187.v2a_b_1ca_54d18d","1191.v168c8c2b_956a","1198.v4d5736c2308c","1206.vc8967cc8a_2cb_","1207.vd28a_54732f92","1212.vd4470d08ff12","1227.v7a_79fc4dc01f","2.0","2.1","2.1.1","2.10","2.11","2.12","2.13","2.14","2.15","2.16","2.17","2.18","2.18.1","2.18.2","2.18.3","2.19","2.2","2.20","2.21","2.22","2.23","2.23.1","2.24","2.25","2.26","2.27","2.28","2.28.1","2.29","2.29-rc1073.41ef89cf4e15","2.3","2.30","2.31-rc1092.de9e11acbcf3","2.31-rc1098.b666422863b2","2.31-rc1107.2354f08725a_8","2.31-rc1118.fdcd7d8898ff","2.4","2.5","2.6","2.8","2.9"]}],"products":[{"vendor":"jenkins","product":"job_configuration_history"},{"vendor":"jenkins project","product":"jenkins job configuration history plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235","tags":["vendor-advisory","x_transferred","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/09/06/9","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41932","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cgh7-rgqg-hrcx"}],"sources":{"cve":[{"id":"CVE-2023-41932","description":"Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.","status":"published","published":"2023-09-06T12:08:53.687Z","modified":"2024-09-26T19:58:14.787Z","updated_at":"2026-11-02T14:35:19.217111Z"}],"euvd":[{"id":"EUVD-2023-2488","description":"Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.","status":"published","published":"2023-09-06T12:08:53Z","modified":"2024-09-26T19:58:14Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"none"}],"updated_at":"2026-11-03T00:28:07.565611Z"}],"ghsa":[{"id":"GHSA-cgh7-rgqg-hrcx","title":"Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin","description":"Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.","status":"published","published":"2023-09-06T15:30:26Z","modified":"2024-01-30T23:11:20Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:33.621286Z"}],"nvd":[{"id":"CVE-2023-41932","description":"Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.","status":"published","published":"2023-09-06T13:15:09.77Z","modified":"2026-06-17T06:23:05.83Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:08:28.268644Z"}],"osv":[{"id":"GHSA-cgh7-rgqg-hrcx","title":"Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin","description":"Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.","status":"published","published":"2023-09-06T15:30:26Z","modified":"2024-02-16T08:13:13.919796Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}