Lucene search

JenkinsCVE-2021-21614

HistoryJan 13, 2021 - 4:15 p.m.

CVE-2021-21614

2021-01-1316:15:14

CWE-522

jenkins

web.nvd.nist.gov

cve-2021-21614

jenkins

bumblebee

hp alm plugin

credentials

unencrypted

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

Percentile

12.6%

JSON

Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Affected configurations

Nvd

Node

jenkinsbumblebee_hp_almRange≤4.1.5jenkins

VendorProductVersionCPE
jenkinsbumblebee_hp_alm*cpe:2.3:a:jenkins:bumblebee_hp_alm:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	bumblebee_hp_alm	*	cpe:2.3:a:jenkins:bumblebee_hp_alm::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Bumblebee HP ALM Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "4.1.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2156

Social References

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2021-21614