PT-2021-14698 · Jenkins · Jenkins P4 Plugin+1

Justin Philip + 2 · CVE-2021-21655 · Published 2021-05-11 · Updated 2023-12-27

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins P4 Plugin versions 1.11.4 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password. The issue is mitigated in version 1.11.5, which requires POST requests for the affected HTTP endpoints.

Recommendations For Jenkins P4 Plugin versions 1.11.4 and earlier, update to version 1.11.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-21655

GHSA-3RJ3-QP2J-4FJ2

Affected Products

Jenkins

Jenkins P4 Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-21655 · Security Note
• https://jenkins.io/security/advisory/2021-05-11/#SECURITY-2327 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3rj3-qp2j-4fj2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21655 · Vendor Advisory
• https://github.com/jenkinsci/p4-plugin/commit/6b0237b04c985987460e31987d3cb314afa1ead6 · Note
• https://github.com/jenkinsci/p4-plugin · Note
• https://t.me/cvenotify/65313 · Telegram Post
• https://t.me/cvenotify/14736 · Telegram Post