PT-2021-14669 · Jenkins · Jenkins Warnings Next Generation Plugin+1

Daniel Beck · Published 2021-03-18 · Updated 2023-10-25 · CVE-2021-21626

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Warnings Next Generation Plugin versions 8.4.4 and earlier

Description The issue allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. This can be exploited through a sequence of requests to effectively list workspace contents.

Recommendations For Jenkins Warnings Next Generation Plugin versions 8.4.4 and earlier, update to version 8.5.0 or later, which requires Item/Configure permission to validate patterns with workspace contents.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-21626

GHSA-7J3X-XM4J-JFJ7

Affected Products

Jenkins

Jenkins Warnings Next Generation Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-7j3x-xm4j-jfj7 · Vendor Advisory
• https://jenkins.io/security/advisory/2021-03-18/#SECURITY-2041 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21626 · Security Note
• https://github.com/jenkinsci/warnings-ng-plugin · Note
• http://openwall.com/lists/oss-security/2021/03/18/5 · Note