CVE-2021-21676
published 2021-06-30CVE-2021-21676: Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
1.39%
69.2th percentile
Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to send test emails to an attacker-specified email address.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fig2dev_project | fig2dev | >= 0 < 1:3.2.6a-6ubuntu1.1 | 1:3.2.6a-6ubuntu1.1 |
| fig2dev_project | fig2dev | >= 0 < 1:3.2.7a-7ubuntu0.1 | 1:3.2.7a-7ubuntu0.1 |
| jenkins | cas_plugin | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| jenkins | requests | <= 2.2.7 | — |
| jenkins | selenium_html_report_plugin | — | — |
| jenkins_project | jenkins_requests-plugin_plugin | unspecified – 2.2.7 | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
osv5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Jenkins
Jenkins Security Advisory 2021-06-30
vendor_jenkins·2021-06-30·CVSS 4.3
CVE-2021-21670 [MEDIUM] Jenkins Security Advisory 2021-06-30
Title: Jenkins Security Advisory 2021-06-30
Jenkins Security Advisory 2021-06-30
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
CAS
Plugin
requests-plugin
Plugin
requests-plugin
Plugin
requests-plugin
Plugin
Selenium HTML report
Plugin
Descriptions
Improper permission checks allow
OSV
fig2dev vulnerabilities
osv·2023-02-13·CVSS 5.5
CVE-2019-14275 fig2dev vulnerabilities
fig2dev vulnerabilities
Frederic Cambus discovered that Fig2dev incorrectly handled certain image
files. If a user or an automated system were tricked into opening a certain
specially crafted input file, a remote attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu 18.04 LTS.
(CVE-2019-14275)
It was discovered that Fig2dev incorrectly handled certain image files. If
a user or an automated system were tricked into opening a certain specially
crafted input file, a remote attacker could possibly use this issue to cause
a denial of service. (CVE-2019-19555, CVE-2019-19797, CVE-2020-21529,
CVE-2020-21530, CVE-2020-21531, CVE-2020-21532, CVE-2020-21533,
CVE-2020-21534, CVE-2020-21535, CVE-2020-21675, CVE-2020-21676,
CVE-2021-3561)
It was discove
OSV
Missing permission check in Jenkins requests-plugin Plugin allows sending emails
osv·2022-05-24
CVE-2021-21676 [MEDIUM] Missing permission check in Jenkins requests-plugin Plugin allows sending emails
Missing permission check in Jenkins requests-plugin Plugin allows sending emails
Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to send test emails to an attacker-specified email address.
Jenkins requests-plugin Plugin 2.2.8 requires Overall/Administer permission to send test emails.
GHSA
Missing permission check in Jenkins requests-plugin Plugin allows sending emails
ghsa·2022-05-24
CVE-2021-21676 [MEDIUM] CWE-862 Missing permission check in Jenkins requests-plugin Plugin allows sending emails
Missing permission check in Jenkins requests-plugin Plugin allows sending emails
Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to send test emails to an attacker-specified email address.
Jenkins requests-plugin Plugin 2.2.8 requires Overall/Administer permission to send test emails.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-06-30
Published