CVE-2021-21626

2021-03-1814:15:13

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.

CPENameOperatorVersion
warnings-ng-plugineqwarnings-ng-8.2.0
warnings-ng-plugineqwarnings-ng-1.0.0-beta8
warnings-ng-plugineqwarnings-ng-2.1.2
warnings-ng-plugineqwarnings-ng-7.1.0
warnings-ng-plugineqwarnings-ng-5.2.0
warnings-ng-plugineqwarnings-ng-8.3.0
warnings-ng-plugineqwarnings-ng-1.0.0-beta1
warnings-ng-plugineqwarnings-ng-2.1.1
warnings-ng-plugineqwarnings-ng-1.0.1
warnings-ng-pluginequntagged-dfa84d73b8bef5cc810f

Name	Operator	Version
warnings-ng-plugin	eq	warnings-ng-8.2.0
warnings-ng-plugin	eq	warnings-ng-1.0.0-beta8
warnings-ng-plugin	eq	warnings-ng-2.1.2
warnings-ng-plugin	eq	warnings-ng-7.1.0
warnings-ng-plugin	eq	warnings-ng-5.2.0
warnings-ng-plugin	eq	warnings-ng-8.3.0
warnings-ng-plugin	eq	warnings-ng-1.0.0-beta1
warnings-ng-plugin	eq	warnings-ng-2.1.1
warnings-ng-plugin	eq	warnings-ng-1.0.1
warnings-ng-plugin	eq	untagged-dfa84d73b8bef5cc810f