CVE-2021-21641: CSRF vulnerability in Jenkins promoted builds Plugin
Summary
CVE-2021-21641: CSRF vulnerability in Jenkins promoted builds Plugin. Affects org.jenkins-ci.plugins:promoted-builds versions < 3.9.1. Fixed in 3.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins promoted builds Plugin is a Maven package that provides functionality for promoting builds in Jenkins. It allows users to define promotion processes and criteria for builds. The plugin is widely used in Jenkins installations and is an integral part of the build promotion workflow. However, versions 3.9 and earlier of the plugin have a vulnerability that allows cross-site request forgery (CSRF) attacks. This means that an attacker can trick a user into performing unintended actions, such as promoting builds, by exploiting the lack of POST request requirement for certain HTTP endpoints.
Vulnerability Detail
The CSRF vulnerability in the Jenkins promoted builds Plugin (versions 3.9 and earlier) allows attackers to perform unauthorized promotion of builds. By tricking a user into visiting a malicious website or clicking on a specially crafted link, an attacker can execute actions on behalf of the user, including promoting builds. This can lead to unauthorized access, data manipulation, and potential disruption of the build process. The vulnerability has been addressed in version 3.9.1 of the plugin, which now requires POST requests for the affected HTTP endpoints.
How To Fix
Latest published version: 1029.v979cc7835e39 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring they do not visit untrusted websites or click on suspicious links. Additionally, users can consider implementing additional security measures, such as using CSRF protection plugins or configuring network firewalls to block malicious requests.
Conclusion
The CSRF vulnerability in the Jenkins promoted builds Plugin (CVE-2021-21641) allows attackers to perform unauthorized promotion of builds. It is recommended to upgrade to version 3.9.1 or later of the plugin to mitigate this vulnerability. Users should follow the standard update process in their Jenkins installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:promoted-builds →
FAQ
The vulnerability allows attackers to promote builds in Jenkins, potentially leading to unauthorized access, data manipulation, and disruption of the build process.
Versions 3.9 and earlier of the plugin are affected by this vulnerability.
Yes, the vulnerability has been fixed in version 3.9.1 of the Jenkins promoted builds Plugin.
Users can update the plugin by following the standard update process in their Jenkins installation.
While there is no specific workaround provided, users can mitigate the risk by avoiding untrusted websites and suspicious links, and by implementing additional security measures.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:promoted-builds.
