CVE-2021-21661

2021-06-1015:15:08

Google

osv.dev

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CPENameOperatorVersion
kubernetes-plugineqkubernetes-1.7.1
kubernetes-plugineqkubernetes-0.12
kubernetes-plugineqkubernetes-1.8.1
kubernetes-plugineqkubernetes-1.1.2
kubernetes-plugineqkubernetes-0.1
kubernetes-plugineqkubernetes-1.2
kubernetes-plugineqkubernetes-1.2.1
kubernetes-plugineqkubernetes-1.9.0
kubernetes-plugineqkubernetes-0.4
kubernetes-plugineqkubernetes-1.9.1

Name	Operator	Version
kubernetes-plugin	eq	kubernetes-1.7.1
kubernetes-plugin	eq	kubernetes-0.12
kubernetes-plugin	eq	kubernetes-1.8.1
kubernetes-plugin	eq	kubernetes-1.1.2
kubernetes-plugin	eq	kubernetes-0.1
kubernetes-plugin	eq	kubernetes-1.2
kubernetes-plugin	eq	kubernetes-1.2.1
kubernetes-plugin	eq	kubernetes-1.9.0
kubernetes-plugin	eq	kubernetes-0.4
kubernetes-plugin	eq	kubernetes-1.9.1