PT-2021-14679 · Jenkins · Jenkins Team Foundation Server Plugin+1

Daniel Beck · Published 2021-03-30 · Updated 2023-10-25 · CVE-2021-21636

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier

Description A missing permission check in the Jenkins Team Foundation Server Plugin allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins. This issue affects the plugin's HTTP endpoint, enabling attackers to obtain credentials IDs that can be used as part of an attack to capture the credentials using another vulnerability.

Recommendations For Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier, as a temporary workaround, consider restricting access to the affected HTTP endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-21636

GHSA-VG28-9F43-GMH5

Affected Products

Jenkins

Jenkins Team Foundation Server Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-vg28-9f43-gmh5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21636 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21636 · Security Note
• https://github.com/jenkinsci/tfs-plugin · Note
• https://jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%281%29 · Note
• http://openwall.com/lists/oss-security/2021/03/30/1 · Note
• https://jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20(1) · Note
• https://t.me/cvenotify/12323 · Telegram Post