PT-2021-14707 · Xebialabs+1 · Jenkins Xebialabs Xl Deploy Plugin+1

Wadeck Follonier · Published 2021-06-10 · Updated 2023-10-25 · CVE-2021-21664

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins XebiaLabs XL Deploy Plugin versions 10.0.1 and earlier

Description An incorrect permission check in the Jenkins XebiaLabs XL Deploy Plugin allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins. The permission check was partially fixed in XebiaLabs XL Deploy Plugin 7.5.9, but it still allows some non-admin users to access the form validation method.

Recommendations For Jenkins XebiaLabs XL Deploy Plugin versions 10.0.1 and earlier, update to a version that includes the complete fix for the incorrect permission check. For versions prior to 7.5.9, consider restricting access to the form validation method to minimize the risk of exploitation. As a temporary workaround, consider disabling the Generic Create permission for non-admin users until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-21664

GHSA-JM4G-8RVQ-V87J

Affected Products

Jenkins

Jenkins Xebialabs Xl Deploy Plugin

References · 8

• https://jenkins.io/security/advisory/2021-06-10/#SECURITY-1982 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21664 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21664 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jm4g-8rvq-v87j · Vendor Advisory
• https://github.com/jenkinsci/xldeploy-plugin · Note
• https://github.com/jenkinsci/xldeploy-plugin/commit/79ae204d2ee6cd94badf4c24a150cee13a3bde44 · Note
• https://t.me/cvenotify/16104 · Telegram Post
• http://openwall.com/lists/oss-security/2021/06/10/14 · Note