CVE-2021-21620: Cross-Site Request Forgery in Jenkins Claim Plugin
Summary
CVE-2021-21620: Cross-Site Request Forgery in the Jenkins Claim plugin. Affects org.jenkins-ci.plugins:claim versions < 2.18.2. Fixed in 2.18.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Claim Plugin is a Maven package (org.jenkins-ci.plugins:claim) that provides functionality for assigning and managing claims in Jenkins. It allows users to make claims on builds and other resources in the Jenkins environment. The plugin is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which can lead to unauthorized changes to claims.
Vulnerability Detail
The vulnerability (CVE-2021-21620) in the Jenkins Claim Plugin (version 2.18.1 and earlier) stems from the lack of requirement for POST requests in the form submission endpoint for assigning claims. This allows an attacker to perform CSRF attacks, tricking authenticated users into unknowingly submitting malicious requests that can change claims. The impact of this vulnerability is that attackers can modify claims, potentially leading to unauthorized access or manipulation of resources in the Jenkins environment.
How To Fix
Minimum fixed version
2.18.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can consider implementing additional security measures such as enforcing CSRF tokens or using other security plugins to protect against CSRF attacks in Jenkins.
Conclusion
The Jenkins Claim Plugin (org.jenkins-ci.plugins:claim) version 2.18.1 and earlier is vulnerable to a CSRF attack, allowing attackers to change claims and potentially gain unauthorized access or manipulate resources in the Jenkins environment. To mitigate this vulnerability, users should upgrade to version 2.18.2 or later of the plugin. Additional security measures such as enforcing CSRF tokens or using other security plugins can also be considered. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:claim →
FAQ
The vulnerability allows attackers to change claims, potentially leading to unauthorized access or manipulation of resources in the Jenkins environment.
Versions 2.18.1 and earlier of the Claim Plugin are affected by this vulnerability.
To mitigate this vulnerability, it is recommended to upgrade to version 2.18.2 or later of the Claim Plugin.
While there is no specific workaround mentioned, users can consider implementing additional security measures such as enforcing CSRF tokens or using other security plugins to protect against CSRF attacks in Jenkins.
You can find more information about this vulnerability in the GitHub Advisory Database at the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:claim.
