CVE-2021-21631

Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages...

com.github.kostyasha.yet-another-docker:yet-another-docker-plugin (>=0.1.0-rc31, <=0.2.0), org.jenkins-ci.plugins.nodesharing:foreman-node-sharing (>=1.2.8, <=1.2.9) +5 more potentially affected by CVE-2021-21631 via org.jenkins-ci.plugins:cloud-stats (>=0.1, <=0.23)

org.jenkins-ci.plugins:cloud-stats MAVEN version =0.1, =0.1.0-rc31, =1.2.8, =2.0.0, =0.4.8, =2.15, =2.6, =2.42 Source cves: CVE-2021-21631 Source advisory: OSV:GHSA-XV69-6RF3-W5G2...

com.github.kostyasha.yet-another-docker:yet-another-docker-plugin (>=0.1.0-rc31, <=0.2.0), org.jenkins-ci.plugins.nodesharing:foreman-node-sharing (>=1.2.8, <=1.2.9) +5 more potentially affected by CVE-2021-21631 via org.jenkins-ci.plugins:cloud-stats (>=0.1, <=0.23)

org.jenkins-ci.plugins:cloud-stats MAVEN version =0.1, =0.1.0-rc31, =1.2.8, =2.0.0, =0.4.8, =2.15, =2.6, =2.42 Source cves: CVE-2021-21631 Source advisory: GHSA-XV69-6RF3-W5G2...

CVE-2021-21631

CVE-2021-21631 affects Jenkins Cloud Statistics Plugin (0.26 and earlier). The vulnerability arises from a missing permission check on an HTTP endpoint, allowing users with Overall/Read to view provisioning exception error messages when they know random activity IDs. Public intake from OSV/GHSA a...