CVE-2021-21645

2021-04-2115:15:08

Google

osv.dev

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.

CPENameOperatorVersion
config-file-provider-plugineqconfig-file-provider-2.7.3
config-file-provider-plugineqconfig-file-provider-2.5.1
config-file-provider-plugineqconfig-file-provider-2.1.1
config-file-provider-plugineqconfig-provider-model-1.3
config-file-provider-plugineqconfig-file-provider-2.7.1
config-file-provider-plugineqconfig-file-provider-2.15.3
config-file-provider-plugineqconfig-file-provider-3.3
config-file-provider-plugineqconfig-file-provider-3.0
config-file-provider-plugineqconfig-file-provider-3.6
config-file-provider-plugineqconfig-file-provider-2.14.2-beta

Name	Operator	Version
config-file-provider-plugin	eq	config-file-provider-2.7.3
config-file-provider-plugin	eq	config-file-provider-2.5.1
config-file-provider-plugin	eq	config-file-provider-2.1.1
config-file-provider-plugin	eq	config-provider-model-1.3
config-file-provider-plugin	eq	config-file-provider-2.7.1
config-file-provider-plugin	eq	config-file-provider-2.15.3
config-file-provider-plugin	eq	config-file-provider-3.3
config-file-provider-plugin	eq	config-file-provider-3.0
config-file-provider-plugin	eq	config-file-provider-3.6
config-file-provider-plugin	eq	config-file-provider-2.14.2-beta