Jenkins Job Configuration History vulnerabilities

7 CVEs affecting Jenkins Job Configuration History, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-57287, published 2026-06-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-41930, published 2023-09-06. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a…
CVE-2023-41933, published 2023-09-06. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-38664, published 2022-08-23. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS)…
CVE-2023-41932, published 2023-09-06. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified…
CVE-2023-41931, published 2023-09-06. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history…
CVE-2022-36887, published 2022-07-27. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system…
CVE-2026-57287, published 2026-06-24. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers…