CVE-2021-21639

CWE-20 — Improper Input Validation6 documents6 sources
Severity
4.3MEDIUM
EPSS
0.9%
top 23.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project JenkinsJenkins Jenkins
Timeline
PublishedApr 7
Latest updateMay 24

Description

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶Mavenorg.jenkins-ci.main:jenkins-core2.278 — 2.287+1
▶NVDjenkins/jenkins2.277.1+1
▶CVEListV5jenkins_project/jenkinsunspecified — 2.286+1

🔴Vulnerability Details

3
GHSA
Lack of type validation in agent related REST API in Jenkins↗2022-05-24
▶
OSV
Lack of type validation in agent related REST API in Jenkins↗2022-05-24
▶
CVEList
CVE-2021-21639: Jenkins 2↗2021-04-07
▶

📋Vendor Advisories

2
Red Hat
jenkins: lack of type validation in agent related REST API↗2021-04-07
▶
Jenkins
Jenkins Security Advisory 2021-04-07↗2021-04-07
▶
CVE-2021-21639 (MEDIUM CVSS 4.3) | Jenkins 2.286 and earlier | cvebase.io