GHSA-PVWX-3JX5-24R2 Lack of type validation in agent related REST API in Jenkins

🗓️ 24 May 2022 17:46:47Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

Jenkins before 2.287 fails to validate node type via config XML REST API, enabling type replacement.

Reporter	Title	Published	Views	Family All 33
FreeBSD	jenkins -- multiple vulnerabilities	7 Apr 202100:00	–	freebsd
AlpineLinux	CVE-2021-21639	7 Apr 202113:50	–	alpinelinux
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.222.43.0.4 / 2.249.30.0.4 / 2.277.2.3 Multiple Vulnerabilities (CloudBees Security Advisory 2021-04-07)	18 Nov 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (9595d002-edeb-4602-be2d-791cd654247e)	14 Apr 202100:00	–	nessus
Tenable Nessus	Jenkins LTS < 2.277.2 / Jenkins weekly < 2.287 Multiple Vulnerabilities	9 Apr 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : OpenShift Container Platform 4.7.11 (RHSA-2021:1551)	20 May 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : OpenShift Container Platform 4.8.2 (RHSA-2021:2437)	27 Jul 202100:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.7.11 (RHSA-2021:1551)	6 May 202600:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.8.2 (RHSA-2021:2437)	6 May 202600:00	–	nessus
CNNVD	Jenkins 输入验证错误漏洞	7 Apr 202100:00	–	cnnvd

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21639
github	www.github.com/jenkinsci/jenkins/commit/84210baed0c866bdee3e59271f98a767a14a5509
github	www.github.com/jenkinsci/jenkins
jenkins	www.jenkins.io/security/advisory/2021-04-07/
openwall	www.openwall.com/lists/oss-security/2021/04/07/2

16 Feb 2024 08:06Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.3

EPSS0.02725

Jenkins node replacement config xml version 2.287 type validation security vulnerability