CVE-2021-21643

2021-04-2115:15:08

Google

osv.dev

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.4%

JSON

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.

CPENameOperatorVersion
config-file-provider-plugineqconfig-file-provider-2.7.3
config-file-provider-plugineqconfig-file-provider-2.5.1
config-file-provider-plugineqconfig-file-provider-2.1.1
config-file-provider-plugineqconfig-provider-model-1.3
config-file-provider-plugineqconfig-file-provider-2.7.1
config-file-provider-plugineqconfig-file-provider-2.15.3
config-file-provider-plugineqconfig-file-provider-3.3
config-file-provider-plugineqconfig-file-provider-3.0
config-file-provider-plugineqconfig-file-provider-3.6
config-file-provider-plugineqconfig-file-provider-2.14.2-beta

Name	Operator	Version
config-file-provider-plugin	eq	config-file-provider-2.7.3
config-file-provider-plugin	eq	config-file-provider-2.5.1
config-file-provider-plugin	eq	config-file-provider-2.1.1
config-file-provider-plugin	eq	config-provider-model-1.3
config-file-provider-plugin	eq	config-file-provider-2.7.1
config-file-provider-plugin	eq	config-file-provider-2.15.3
config-file-provider-plugin	eq	config-file-provider-3.3
config-file-provider-plugin	eq	config-file-provider-3.0
config-file-provider-plugin	eq	config-file-provider-3.6
config-file-provider-plugin	eq	config-file-provider-2.14.2-beta