PT-2021-14714 · Jenkins · Jenkins

Published 2021-06-30 · Updated 2024-03-06 · CVE-2021-21671

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.299 and earlier Jenkins LTS versions 2.289.1 and earlier

Description The issue arises because Jenkins does not invalidate the previous session on login, allowing attackers to potentially use social engineering techniques to gain administrator access. This vulnerability was introduced in Jenkins 2.266 and LTS 2.277.1.

Recommendations For Jenkins versions 2.299 and earlier, update to version 2.300 or later to invalidate the previous session on login. For Jenkins LTS versions 2.289.1 and earlier, update to version 2.289.2 or later to invalidate the previous session on login. As a temporary workaround, consider setting the Java system property hudson.security.SecurityRealm.sessionFixationProtectionMode to 2 to choose a different implementation, or set it to 0 to disable the fix entirely, but this is not recommended as it may introduce security risks.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BIT-JENKINS-2021-21671

CVE-2021-21671

GHSA-4WR9-2XC6-JMG5

RHSA-2021:3820

Affected Products

Jenkins

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-21671 · Security Note
• https://osv.dev/vulnerability/BIT-jenkins-2021-21671 · Vendor Advisory
• https://jenkins.io/security/advisory/2021-06-30/#SECURITY-2371 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4wr9-2xc6-jmg5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21671 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/25a42f3942fd9f8bd768c887c679dbc796b4fcd5 · Note
• http://openwall.com/lists/oss-security/2021/06/30/1 · Note
• https://t.me/cibsecurity/25833 · Telegram Post
• https://t.me/cvenotify/16945 · Telegram Post