CVE-2021-21607

🗓️ 13 Jan 2021 15:55:30Reported by jenkinsType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 183 Views

Jenkins 2.274 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, enabling attackers to request crafted URLs causing out of memory errors

Reporter	Title	Published	Views	Family All 39
AlpineLinux	CVE-2021-21607	13 Jan 202115:55	–	alpinelinux
ArchLinux	[ASA-202101-41] jenkins: multiple issues	20 Jan 202100:00	–	archlinux
Circl	CVE-2021-21607	13 Jan 202119:25	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.222.43.0.1 / 2.249.30.0.1 / 2.263.2.2 Multiple Vulnerabilities (CloudBees Security Advisory 2021-01-13)	29 Nov 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (d6f76976-e86d-4f9a-9362-76c849b10db2)	14 Jan 202100:00	–	nessus
Tenable Nessus	Jenkins < 2.263.2 LTS / 2.275 Multiple Vulnerabilities	22 Jan 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.6.17 (RHSA-2021:0423)	18 Feb 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : OpenShift Container Platform 4.5.33 (RHSA-2021:0429)	3 Mar 202100:00	–	nessus
Tenable Nessus	RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)	3 Mar 202100:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.6.17 (RHSA-2021:0423)	6 May 202600:00	–	nessus

NVD

Node

jenkins jenkinsRange≤2.263.1lts

jenkins jenkinsRange≤2.274-

[
  {
    "product": "Jenkins",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "2.274",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "LTS 2.263.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
jenkins	www.jenkins.io/security/advisory/2021-01-13/

21 Nov 2024 05:48Current

6.7Medium risk

Vulners AI Score6.7

CVSS 24

CVSS 3.16.5

EPSS0.00275

CWE-770