Vulnerability-Lookup

CVE-2021-21643 (GCVE-0-2021-21643)

Vulnerability from cvelistv5 – Published: 2021-04-21 14:20 – Updated: 2024-08-03 18:16

Summary

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Assigner

jenkins mitre root

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2021-04-…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2021/04/21/2	mailing-listx_refsource_MLIST

Impacted products

1 product

Vendor	Product	Version	CPE status
Jenkins project	Jenkins Config File Provider Plugin	Affected: unspecified , ≤ 3.7.0 (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:16:23.896Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
          },
          {
            "name": "[oss-security] 20210421 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Config File Provider Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "3.7.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T15:51:07.148Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
        },
        {
          "name": "[oss-security] 20210421 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2021-21643",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Config File Provider Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.7.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-863: Incorrect Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
            },
            {
              "name": "[oss-security] 20210421 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2021-21643",
    "datePublished": "2021-04-21T14:20:28.000Z",
    "dateReserved": "2021-01-04T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:16:23.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-21643",
      "date": "2026-09-19",
      "epss": "0.01082",
      "percentile": "0.63672"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*",
                  "matchCriteriaId": "D9585A7C-580E-4D27-9986-4F5EA086D70C",
                  "versionEndIncluding": "3.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins."
        },
        {
          "lang": "es",
          "value": "Jenkins Config File Provider Plugin versiones 3.7.0 y anteriores, no lleva a cabo apropiadamente unas comprobaciones de permisos en varios endpoints HTTP, lo que permite a atacantes con permiso global Job/Configure enumerar unas ID de credenciales del \u00e1mbito del sistema de las credenciales almacenadas en Jenkins"
        }
      ],
      "id": "CVE-2021-21643",
      "lastModified": "2024-11-21T05:48:45.340",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "NONE",
              "baseScore": 4.0,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "NONE",
              "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 8.0,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2021-04-21T15:15:08.340",
      "references": [
        {
          "source": "jenkinsci-cert@googlegroups.com",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
        },
        {
          "source": "jenkinsci-cert@googlegroups.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
        }
      ],
      "sourceIdentifier": "jenkinsci-cert@googlegroups.com",
      "vulnStatus": "Modified"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*",
                    "matchCriteriaId": "D9585A7C-580E-4D27-9986-4F5EA086D70C",
                    "versionEndIncluding": "3.7.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins."
          },
          {
            "lang": "es",
            "value": "Jenkins Config File Provider Plugin versiones 3.7.0 y anteriores, no lleva a cabo apropiadamente unas comprobaciones de permisos en varios endpoints HTTP, lo que permite a atacantes con permiso global Job/Configure enumerar unas ID de credenciales del \u00e1mbito del sistema de las credenciales almacenadas en Jenkins"
          }
        ],
        "id": "CVE-2021-21643",
        "lastModified": "2024-11-21T05:48:45.340",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "NONE",
                "baseScore": 4.0,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-04-21T15:15:08.340",
        "references": [
          {
            "source": "jenkinsci-cert@googlegroups.com",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
          },
          {
            "source": "jenkinsci-cert@googlegroups.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
          }
        ],
        "sourceIdentifier": "jenkinsci-cert@googlegroups.com",
        "vulnStatus": "Modified"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-11T15:09:44+00:00",
      "cve": "CVE-2021-21643",
      "id": "CVE-2021-21643",
      "initial_release_date": "2021-04-21T00:00:00+00:00",
      "product_status:fixed": "377",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP endpoints.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-21643.json",
      "version": "3"
    }
  }
}

CNVD-2021-31169

Vulnerability from cnvd - Published: 2021-04-26

Title

CloudBees Jenkins Config File Provider Plugin权限检查漏洞

Description

CloudBees Jenkins（前称Hudson Labs）是美国CloudBees公司的一套基于Java开发的持续集成工具，它主要用于监控持续的软件版本发布/测试项目和一些定时执行的任务。Config File Provider Plugin是使用在其中的一个配置文件管理插件。 Jenkins Config File Provider Plugin 3.7.0及之前版本存在权限检查漏洞。该漏洞源于程序未在多个HTTP端点中执行正确的权限检查。具备Job/Configure权限的攻击者可利用该漏洞泄露存储在Jenkins中的系统范围内的凭据id。

Severity

中

Patch Name

CloudBees Jenkins Config File Provider Plugin权限检查漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-21643

Impacted products

Name
CloudBees Jenkins Config File Provider Plugin <=3.7.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-21643",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-21643"
    }
  },
  "description": "CloudBees Jenkins\uff08\u524d\u79f0Hudson Labs\uff09\u662f\u7f8e\u56fdCloudBees\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8eJava\u5f00\u53d1\u7684\u6301\u7eed\u96c6\u6210\u5de5\u5177\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u76d1\u63a7\u6301\u7eed\u7684\u8f6f\u4ef6\u7248\u672c\u53d1\u5e03/\u6d4b\u8bd5\u9879\u76ee\u548c\u4e00\u4e9b\u5b9a\u65f6\u6267\u884c\u7684\u4efb\u52a1\u3002Config File Provider Plugin\u662f\u4f7f\u7528\u5728\u5176\u4e2d\u7684\u4e00\u4e2a\u914d\u7f6e\u6587\u4ef6\u7ba1\u7406\u63d2\u4ef6\u3002\n\nJenkins Config File Provider Plugin 3.7.0\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u6743\u9650\u68c0\u67e5\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u5728\u591a\u4e2aHTTP\u7aef\u70b9\u4e2d\u6267\u884c\u6b63\u786e\u7684\u6743\u9650\u68c0\u67e5\u3002\u5177\u5907Job/Configure\u6743\u9650\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6cc4\u9732\u5b58\u50a8\u5728Jenkins\u4e2d\u7684\u7cfb\u7edf\u8303\u56f4\u5185\u7684\u51ed\u636eid\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-31169",
  "openTime": "2021-04-26",
  "patchDescription": "CloudBees Jenkins\uff08\u524d\u79f0Hudson Labs\uff09\u662f\u7f8e\u56fdCloudBees\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8eJava\u5f00\u53d1\u7684\u6301\u7eed\u96c6\u6210\u5de5\u5177\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u76d1\u63a7\u6301\u7eed\u7684\u8f6f\u4ef6\u7248\u672c\u53d1\u5e03/\u6d4b\u8bd5\u9879\u76ee\u548c\u4e00\u4e9b\u5b9a\u65f6\u6267\u884c\u7684\u4efb\u52a1\u3002Config File Provider Plugin\u662f\u4f7f\u7528\u5728\u5176\u4e2d\u7684\u4e00\u4e2a\u914d\u7f6e\u6587\u4ef6\u7ba1\u7406\u63d2\u4ef6\u3002\r\n\r\nJenkins Config File Provider Plugin 3.7.0\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u6743\u9650\u68c0\u67e5\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u5728\u591a\u4e2aHTTP\u7aef\u70b9\u4e2d\u6267\u884c\u6b63\u786e\u7684\u6743\u9650\u68c0\u67e5\u3002\u5177\u5907Job/Configure\u6743\u9650\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6cc4\u9732\u5b58\u50a8\u5728Jenkins\u4e2d\u7684\u7cfb\u7edf\u8303\u56f4\u5185\u7684\u51ed\u636eid\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "CloudBees Jenkins Config File Provider Plugin\u6743\u9650\u68c0\u67e5\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "CloudBees Jenkins Config File Provider Plugin \u003c=3.7.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-21643",
  "serverity": "\u4e2d",
  "submitTime": "2021-04-23",
  "title": "CloudBees Jenkins Config File Provider Plugin\u6743\u9650\u68c0\u67e5\u6f0f\u6d1e"
}

FKIE_CVE-2021-21643

Vulnerability from fkie_nvd - Published: 2021-04-21 15:15 - Updated: 2026-06-17 03:35

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
jenkinsci-cert@googlegroups.com	http://www.openwall.com/lists/oss-security/2021/04/21/2	Mailing List, Third Party Advisory
jenkinsci-cert@googlegroups.com	https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2021/04/21/2	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254	Vendor Advisory

Impacted products

	Vendor	Product	Version
	jenkins	config_file_provider	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Jenkins Config File Provider Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "3.7.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "jenkinsci-cert@googlegroups.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*",
              "matchCriteriaId": "D9585A7C-580E-4D27-9986-4F5EA086D70C",
              "versionEndIncluding": "3.7.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins."
    },
    {
      "lang": "es",
      "value": "Jenkins Config File Provider Plugin versiones 3.7.0 y anteriores, no lleva a cabo apropiadamente unas comprobaciones de permisos en varios endpoints HTTP, lo que permite a atacantes con permiso global Job/Configure enumerar unas ID de credenciales del \u00e1mbito del sistema de las credenciales almacenadas en Jenkins"
    }
  ],
  "id": "CVE-2021-21643",
  "lastModified": "2026-06-17T03:35:55.413",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-04-21T15:15:08.340",
  "references": [
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
    },
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
    }
  ],
  "sourceIdentifier": "jenkinsci-cert@googlegroups.com",
  "vulnStatus": "Modified"
}

GHSA-3M3F-2323-64M7

Vulnerability from github – Published: 2022-05-24 17:48 – Updated: 2023-10-27 14:18

Summary

Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs

Details

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints.

This allows attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of system-scoped credentials IDs in Jenkins Config File Provider Plugin 3.7.1 requires Overall/Administer permission.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.7.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:config-file-provider"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21643"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-13T19:26:21Z",
    "nvd_published_at": "2021-04-21T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints.\n\nThis allows attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\nAn enumeration of system-scoped credentials IDs in Jenkins Config File Provider Plugin 3.7.1 requires Overall/Administer permission.",
  "id": "GHSA-3m3f-2323-64m7",
  "modified": "2023-10-27T14:18:39Z",
  "published": "2022-05-24T17:48:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21643"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/config-file-provider-plugin/commit/d615e3278358b033f5e8d0d2e3f38f467b0e29f2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/config-file-provider-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs"
}

GSD-2021-21643

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-21643

Aliases

CVE-2021-21643

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-21643",
    "description": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.",
    "id": "GSD-2021-21643",
    "references": [
      "https://access.redhat.com/errata/RHBA-2021:2854",
      "https://access.redhat.com/errata/RHSA-2021:2517",
      "https://access.redhat.com/errata/RHSA-2021:2431",
      "https://access.redhat.com/errata/RHBA-2021:2407",
      "https://access.redhat.com/errata/RHSA-2021:2122"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-21643"
      ],
      "details": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.",
      "id": "GSD-2021-21643",
      "modified": "2023-12-13T01:23:11.105232Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "jenkinsci-cert@googlegroups.com",
        "ID": "CVE-2021-21643",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Jenkins Config File Provider Plugin",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "unspecified",
                          "version_value": "3.7.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Jenkins project"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254",
            "refsource": "MISC",
            "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
          },
          {
            "name": "http://www.openwall.com/lists/oss-security/2021/04/21/2",
            "refsource": "MISC",
            "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,3.7.0]",
          "affected_versions": "All versions up to 3.7.0",
          "cvss_v2": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-863",
            "CWE-937"
          ],
          "date": "2022-12-13",
          "description": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.",
          "fixed_versions": [
            "3.7.1"
          ],
          "identifier": "CVE-2021-21643",
          "identifiers": [
            "GHSA-3m3f-2323-64m7",
            "CVE-2021-21643"
          ],
          "not_impacted": "All versions after 3.7.0",
          "package_slug": "maven/org.jenkins-ci.plugins/config-file-provider",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to version 3.7.1 or above.",
          "title": "Incorrect Authorization",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-21643",
            "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254",
            "http://www.openwall.com/lists/oss-security/2021/04/21/2",
            "https://github.com/advisories/GHSA-3m3f-2323-64m7"
          ],
          "uuid": "f5fc05ff-ff31-4c80-a72d-3f8969fbc7e9"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.7.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2021-21643"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": []
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2254"
            },
            {
              "name": "[oss-security] 20210421 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2021/04/21/2"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-10-25T18:16Z",
      "publishedDate": "2021-04-21T15:15Z"
    }
  }
}

RHBA-2021:2407

Vulnerability from csaf_redhat - Published: 2021-06-22 07:58 - Updated: 2026-08-11 15:09

Summary

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6.35 packages update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2021-21643.

CVE-2021-21643

A flaw was found in the config-file-provider Jenkins plugin. The plugin does not correctly perform permission checks in several HTTP endpoints, as a consequence an attacker with global Job/Configure permission can enumerate system-scoped credentials IDs of credentials stored in Jenkins.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fixed: 2 products Known not affected: 38 products

https://access.redhat.com/errata/RHBA-2021:2407

Open the full advisory

RHBA-2021:2854

Vulnerability from csaf_redhat - Published: 2021-07-21 17:05 - Updated: 2026-08-13 19:43

Summary

Red Hat Bug Fix Advisory: Migration Toolkit for Containers (MTC) 1.4.6 release advisory

Severity

Important

Scope

23 vulnerabilities in this advisory, including CVE-2021-21643.

CVE-2021-21643

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fixed: 13 products

https://access.redhat.com/errata/RHBA-2021:2854

Open the full advisory

RHBA-2021_2407

Vulnerability from csaf_redhat - Published: 2021-06-22 07:58 - Updated: 2024-11-22 17:01

Summary

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6.35 packages update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2021-21643.

CVE-2021-21643

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fixed: 2 products Known not affected: 38 products

https://access.redhat.com/errata/RHBA-2021:2407

Open the full advisory

RHBA-2021_2854

Vulnerability from csaf_redhat - Published: 2021-07-21 17:05 - Updated: 2024-11-24 20:21

Summary

Red Hat Bug Fix Advisory: Migration Toolkit for Containers (MTC) 1.4.6 release advisory

Severity

Important

Scope

23 vulnerabilities in this advisory, including CVE-2021-21643.

CVE-2021-21643

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fixed: 13 products

https://access.redhat.com/errata/RHBA-2021:2854

Open the full advisory

RHSA-2021:2122

Vulnerability from csaf_redhat - Published: 2021-06-01 04:12 - Updated: 2026-08-11 15:09

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.7.13 packages and security update

Severity

Important

Scope

6 vulnerabilities in this advisory, including CVE-2021-21643.

CVE-2021-21643

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fixed: 22 products

https://access.redhat.com/errata/RHSA-2021:2122

Open the full advisory

RHSA-2021:2431

Vulnerability from csaf_redhat - Published: 2021-07-02 00:20 - Updated: 2026-08-11 15:09

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.5.41 security update

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2021-21643.

CVE-2021-21643

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fixed: 2 products Known not affected: 36 products

https://access.redhat.com/errata/RHSA-2021:2431

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-21643 (GCVE-0-2021-21643)

Tags

Sightings

Nomenclature

Related by attack behaviour