Lucene search

JenkinsCVELIST:CVE-2021-21621

HistoryFeb 24, 2021 - 3:05 p.m.

CVE-2021-21621

2021-02-2415:05:30

jenkins

www.cve.org

jenkins

support core plugin

user authentication

session id

vulnerability

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

35.9%

JSON

Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the “About user (basic authentication details only)” information, which can include the session ID of the user creating the support bundle in some configurations.

CNA Affected

[
  {
    "product": "Jenkins Support Core Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "2.72",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "2.70.1"
      },
      {
        "status": "unaffected",
        "version": "2.68.1"
      }
    ]
  }
]

References

www.jenkins.io/security/advisory/2021-02-24/#SECURITY-2150