CVE-2021-21623
published 2021-03-18CVE-2021-21623: An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.01%
59.1th percentile
An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | aws_credentials_plugin | — | — |
| jenkins | folders_plugin | — | — |
| jenkins | libvirt_agents_plugin | — | — |
| jenkins | matrix_authorization_strategy | <= 2.6.5 | — |
| jenkins | matrix_authorization_strategy_plugin | — | — |
| jenkins | role-based_authorization_strategy_plugin | — | — |
| jenkins | warnings_plugin | — | — |
| jenkins_project | jenkins_matrix_authorization_strategy_plugin | unspecified – 2.6.5 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items
osv·2022-05-24
CVE-2021-21623 [MEDIUM] Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items
Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items
Items (like jobs) can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well.
Matrix Authorization Strategy Plugin 2.6.5 and earlier does not correctly perform permission checks to determine whether an item should be accessible.
This allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.\n\nMatrix Authorization Strategy Plugin 2.6.6 requires Item/Read permission on parent items to grant Item/Read permission on an individual item.
As a workaround in older releases, do not grant permission
GHSA
Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items
ghsa·2022-05-24
CVE-2021-21623 [MEDIUM] CWE-863 Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items
Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items
Items (like jobs) can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well.
Matrix Authorization Strategy Plugin 2.6.5 and earlier does not correctly perform permission checks to determine whether an item should be accessible.
This allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.\n\nMatrix Authorization Strategy Plugin 2.6.6 requires Item/Read permission on parent items to grant Item/Read permission on an individual item.
As a workaround in older releases, do not grant permission
Red Hat
jenkins-2-plugins/matrix-auth: Incorrect permission checks in Matrix Authorization Strategy Plugin
vendor_redhat·2021-03-18·CVSS 6.5
CVE-2021-21623 [MEDIUM] CWE-273 jenkins-2-plugins/matrix-auth: Incorrect permission checks in Matrix Authorization Strategy Plugin
jenkins-2-plugins/matrix-auth: Incorrect permission checks in Matrix Authorization Strategy Plugin
An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.
A flaw was found in Jenkins Matrix Authorization Strategy Plugin. The jenkins plugin does not correctly perform permission checks, as consequences this allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders. The highest threat from this vulnerability is to data confidentiality.
Package: jenkins (Red Hat OpenShift Container Platform 3.11) - Out of support scope
Package: jenkins-2-plugins
Jenkins
Jenkins Security Advisory 2021-03-18
vendor_jenkins·2021-03-18·CVSS 6.5
CVE-2021-21623 [MEDIUM] Jenkins Security Advisory 2021-03-18
Title: Jenkins Security Advisory 2021-03-18
Jenkins Security Advisory 2021-03-18
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
AWS Credentials
Plugin
Libvirt Agents
Plugin
Matrix Authorization Strategy
Plugin
Role-based Authorization Strategy
Plugin
Warnings
Plugin
Descriptions
Incorrect permissi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-03-18
Published