CVE-2021-21629: CSRF vulnerability in Jenkins Build With Parameters Plugin
Summary
CVE-2021-21629: CSRF vulnerability in Jenkins Build With Parameters Plugin. Affects org.jenkins-ci.plugins:build-with-parameters versions < 1.5.1. Fixed in 1.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Build With Parameters Plugin is a Maven package that allows users to build projects with specified parameters. It provides a form submission endpoint for users to submit their desired parameters and initiate a build. However, versions 1.5 and earlier of the plugin do not require POST requests for form submission, making it vulnerable to cross-site request forgery (CSRF) attacks. This means that an attacker can trick a user into unknowingly submitting a form and building a project with the attacker's specified parameters.
Vulnerability Detail
The CSRF vulnerability in the Jenkins Build With Parameters Plugin allows attackers to manipulate the parameters used in project builds. By exploiting this vulnerability, an attacker can potentially execute unauthorized actions, modify project configurations, or disrupt the build process. This can lead to various security risks, such as unauthorized access, data manipulation, or denial of service.
How To Fix
Latest published version: 81.ve4a_9c2499d9a as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a workaround by manually modifying the plugin code to enforce POST requests for the form submission endpoint. Here is an example of the code change:
- Open the 'build-with-parameters.hpi' file located in the Jenkins plugins directory.
- Navigate to the 'BuildWithParametersAction.java' file within the plugin.
- Locate the 'doBuild' method.
- Add the following code snippet at the beginning of the method:
if (!request.getMethod().equals("POST")) {
throw new ServletException("Invalid request method. POST request required.");
}
- Save the changes and restart Jenkins for the modifications to take effect.
Please note that manually modifying the plugin code is not recommended and may introduce other issues. It is always best to update to the latest version provided by the plugin maintainers.
Conclusion
The CSRF vulnerability in the Jenkins Build With Parameters Plugin (CVE-2021-21629) allows attackers to manipulate project build parameters through unauthorized form submissions. To mitigate this vulnerability, it is crucial to upgrade to version 1.5.1 or later of the plugin, which requires POST requests for form submission. Users can also use the Vulert Playground to check if their Jenkins installation is affected. Promptly addressing this vulnerability is essential to prevent potential unauthorized actions, data manipulation, or disruption of the build process. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:build-with-parameters →
FAQ
This vulnerability allows attackers to manipulate the parameters used in project builds, potentially leading to unauthorized actions, data manipulation, or disruption of the build process.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply enter your Jenkins project's pom.xml file and the playground will analyze it for any open-source vulnerabilities, including this CSRF vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly address and fix the vulnerability to prevent potential exploitation.
Yes, a patch is available for this vulnerability. Users should upgrade to version 1.5.1 or later of the Build With Parameters Plugin to fix the CSRF vulnerability.
If upgrading to the latest version is not immediately feasible, you can implement the provided workaround by manually modifying the plugin code to enforce POST requests for the form submission endpoint. However, it is recommended to update to the latest version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:build-with-parameters.
