CVE-2021-21645

4.3 mediumEPSS 0.9%

Medium (4.3) in jenkins config file provider. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.plugins:config-file-provider 3.7.1.

Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
Published: 2021-04-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:config_file_provider

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-2959-fj73-hm8p	Maven	org.jenkins-ci.plugins:config-file-provider	<3.7.1	3.7.1

References

http://www.openwall.com/lists/oss-security/2021/04/21/2
https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2203
http://www.openwall.com/lists/oss-security/2021/04/21/2
https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2203

Check your stack JSON