CVE-2021-21651: Missing Authorization in Jenkins S3 publisher Plugin
Summary
CVE-2021-21651: Missing Authorization in Jenkins S3 publisher Plugin. Affects org.jenkins-ci.plugins:s3 across 2 version ranges.
< 0.11.5.1
>= 0.11.6, < 0.11.7
Fixed in 0.11.5.1 or 0.11.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins S3 publisher Plugin is a Maven package that provides functionality for publishing artifacts to Amazon S3 buckets. It is commonly used in Jenkins CI/CD pipelines to store build artifacts and other files. The plugin allows users to configure profiles for different S3 buckets and credentials. However, prior to version 0.11.7 and 0.11.5.1, the plugin did not perform a permission check in an HTTP endpoint, which could lead to unauthorized access to the list of configured profiles.
Vulnerability Detail
The vulnerability (CVE-2021-21651) in the Jenkins S3 publisher Plugin allows attackers with Overall/Read permission to obtain the list of configured profiles. This means that an attacker with the necessary permissions could potentially gain access to sensitive information, such as S3 bucket names and credentials. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.11.5.10.11.5.1 -
>= 0.11.6, < 0.11.70.11.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to upgrade to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The Jenkins S3 publisher Plugin prior to version 0.11.7 and 0.11.5.1 is vulnerable to unauthorized access to the list of configured profiles. It is recommended to upgrade to the fixed version to mitigate this vulnerability. Vulert's playground can be used to check if your application is affected, and for additional support, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:s3 →
FAQ
The vulnerability allows unauthorized users with Overall/Read permission to obtain the list of configured profiles, potentially exposing sensitive information.
Users of Jenkins S3 publisher Plugin versions prior to 0.11.7 and 0.11.5.1 are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this report.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
For further support on vulnerability remediation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:s3.
