PT-2021-14689 · Jenkins · Jenkins Templating Engine Plugin+2

Daniel Beck · Published 2021-04-21 · Updated 2023-10-25 · CVE-2021-21646

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Templating Engine Plugin versions 2.1 and earlier

Description The issue allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. This is due to the lack of protection for pipeline configurations using the Script Security Plugin.

Recommendations For Jenkins Templating Engine Plugin versions 2.1 and earlier, update to version 2.2, which integrates with the Script Security Plugin to protect pipeline configurations.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2021-21646

GHSA-P6QC-37HQ-WQR6

Affected Products

Jenkins

Jenkins Templating Engine Plugin

Script Security Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-p6qc-37hq-wqr6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21646 · Vendor Advisory
• https://jenkins.io/security/advisory/2021-04-21/#SECURITY-2311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21646 · Security Note
• https://github.com/jenkinsci/templating-engine-plugin · Note
• https://github.com/jenkinsci/templating-engine-plugin/commit/aed14bed7333329f51330d0a8111e4d94cdee3e6 · Note
• http://openwall.com/lists/oss-security/2021/04/21/2 · Note
• https://t.me/cvenotify/13745 · Telegram Post