PT-2021-14713 · Jenkins · Jenkins

Angã©Lique Jard · Published 2021-06-30 · Updated 2024-03-06 · CVE-2021-21670

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.299 and earlier Jenkins LTS versions 2.289.1 and earlier

Description The issue allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission. This can be exploited by users with Item/Cancel permission to affect jobs without having the necessary Item/Read permission.

Recommendations For Jenkins versions 2.299 and earlier, do not grant Item/Cancel permission to users who do not have Item/Read permission as a workaround. For Jenkins LTS versions 2.289.1 and earlier, do not grant Item/Cancel permission to users who do not have Item/Read permission as a workaround.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-JENKINS-2021-21670

CVE-2021-21670

GHSA-Q4WP-8C99-69PW

RHSA-2021:3820

Affected Products

Jenkins

References · 9

• https://jenkins.io/security/advisory/2021-06-30/#SECURITY-2278 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21670 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q4wp-8c99-69pw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21670 · Security Note
• https://osv.dev/vulnerability/BIT-jenkins-2021-21670 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/86b7d7e789586575522650c60d591605facb1d70 · Note
• http://openwall.com/lists/oss-security/2021/06/30/1 · Note
• https://t.me/cvenotify/16946 · Telegram Post