PT-2021-14687 · Jenkins · Jenkins Config File Provider Plugin+1

Published 2021-04-21 · Updated 2023-11-30 · CVE-2021-21644

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins Config File Provider Plugin versions 3.7.0 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to delete configuration files corresponding to an attacker-specified ID. This issue arises because the plugin does not require POST requests for a specific HTTP endpoint. The vulnerability is a result of an incomplete fix of a previous security issue.

Recommendations For Jenkins Config File Provider Plugin versions 3.7.0 and earlier, update to version 3.7.1 or later, which requires POST requests for the affected HTTP endpoint, thereby mitigating the CSRF vulnerability.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-21644

GHSA-998M-F2X3-JJQ4

RHSA-2021:2122

RHSA-2021:2431

RHSA-2021:2517

Affected Products

Jenkins

Jenkins Config File Provider Plugin

References · 8

• https://jenkins.io/security/advisory/2021-04-21/#SECURITY-2202 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-998m-f2x3-jjq4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21644 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21644 · Vendor Advisory
• https://github.com/jenkinsci/config-file-provider-plugin/commit/9ffc32379477c4395ab17ff19b04b9f1286ceedb · Note
• https://github.com/jenkinsci/config-file-provider-plugin · Note
• https://t.me/cvenotify/61772 · Telegram Post
• http://openwall.com/lists/oss-security/2021/04/21/2 · Note