Lucene search
GoogleOSV:GHSA-Q4WP-8C99-69PWHistoryMay 24, 2022 - 7:06 p.m.
Improper permission checks allow canceling queue items and aborting builds in Jenkins
2022-05-2419:06:36
Google
osv.dev
13
improper permission checks
jenkins
queue items
abort builds
security issue
EPSS
0.001
Percentile
22.0%
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.
Jenkins 2.300, LTS 2.289.2 requires that users have Item/Read permission for applicable types in addition to Item/Cancel permission.
As a workaround on earlier versions of Jenkins, do not grant Item/Cancel permission to users who do not have Item/Read permission.
Related
osv
osv
BIT-jenkins-2021-21670
2024-03-06 11:01:53
CVE-2021-21670
2021-06-30 17:15:08
veracode
veracode
Incorrect Authorization
2021-09-30 00:02:06
prion
prion
Design/Logic Flaw
2021-06-30 17:15:00
redhatcve
redhatcve
CVE-2021-21670
2021-09-24 19:15:49
cvelist
cvelist
CVE-2021-21670
2021-06-30 16:45:16
cve
cve
CVE-2021-21670
2021-06-30 17:15:08
alpinelinux
alpinelinux
CVE-2021-21670
2021-06-30 17:15:00
github
github
nvd
nvd
CVE-2021-21670
2021-06-30 17:15:08
archlinux
archlinux
[ASA-202107-5] jenkins: multiple issues
2021-07-01 00:00:00
nessus
nessus
Jenkins Enterprise and Operations Center < 2.249.31.0.6 / 2.277.40.0.1 / 2.289.2.2 Multiple Vulnerabilities (CloudBees Security Advisory 2021-06-30)
2021-10-11 00:00:00
FreeBSD : jenkins -- multiple vulnerabilities (9d271bab-da22-11eb-86f0-94c691a700a6)
2021-07-02 00:00:00
Jenkins LTS < 2.289.2 / Jenkins weekly < 2.300 Multiple Vulnerabilities
2021-06-30 00:00:00
openvas
openvas
Jenkins < 2.289.2, < 2.300 Multiple Vulnerabilities - Windows
2021-07-01 00:00:00
Jenkins < 2.289.2, < 2.300 Multiple Vulnerabilities - Linux
2021-07-01 00:00:00
freebsd
freebsd
jenkins -- multiple vulnerabilities
2021-06-30 00:00:00
redhat
redhat