PT-2021-14705 · Xebialabs+1 · Jenkins Xebialabs Xl Deploy Plugin+1

Arnaud Hã©Ritier · Published 2021-06-10 · Updated 2023-10-25 · CVE-2021-21662

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins XebiaLabs XL Deploy Plugin versions 10.0.1 and earlier

Description A missing permission check in the plugin allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins. This issue is related to a method implementing form validation that does not perform a permission check, enabling attackers to obtain credentials IDs that can be used as part of an attack to capture the credentials using another vulnerability.

Recommendations For Jenkins XebiaLabs XL Deploy Plugin versions 10.0.1 and earlier, consider updating to a version that includes the necessary permission checks to prevent credentials ID enumeration. As a temporary workaround, restrict access to the plugin's form validation method to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-21662

GHSA-H246-G39X-7VMX

Affected Products

Jenkins

Jenkins Xebialabs Xl Deploy Plugin

References · 7

• https://jenkins.io/security/advisory/2021-06-10/#SECURITY-1981 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h246-g39x-7vmx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21662 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21662 · Vendor Advisory
• https://github.com/jenkinsci/xldeploy-plugin · Note
• https://github.com/jenkinsci/xldeploy-plugin/commit/79ae204d2ee6cd94badf4c24a150cee13a3bde44 · Note
• http://openwall.com/lists/oss-security/2021/06/10/14 · Note