CVE-2021-21653: Missing Authorization in jenkins xray-connector
Summary
CVE-2021-21653: Missing Authorization in jenkins xray-connector. Affects org.jenkins-ci.plugins:xray-connector versions < 2.4.1. Fixed in 2.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jenkins xray-connector is a plugin for Jenkins that provides test management capabilities for Jira. It allows users to integrate Jira with Jenkins and manage test cases, test results, and other testing-related activities. The plugin is widely used in software development and testing workflows.
Vulnerability Detail
The jenkins xray-connector plugin version 2.4.0 and earlier has a missing authorization vulnerability. It fails to perform a permission check in an HTTP endpoint, which allows users with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This vulnerability can be exploited by an attacker to gain unauthorized access to sensitive credentials, potentially leading to further security breaches or unauthorized actions within the Jenkins environment.
How To Fix
Minimum fixed version
2.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected HTTP endpoint by modifying the Jenkins configuration or firewall rules. By limiting access to trusted users or IP addresses, the risk of unauthorized access can be mitigated. However, applying the recommended fix by upgrading to the latest version is the best long-term solution.
Conclusion
The jenkins xray-connector plugin version 2.4.0 and earlier is vulnerable to a missing authorization issue, which can allow unauthorized access to sensitive credentials. It is recommended to upgrade to version 2.4.1 or later to fix this vulnerability. Applying proper access restrictions and monitoring for any unauthorized activities are also advised. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:xray-connector →
FAQ
This vulnerability allows users with Overall/Read permission to enumerate credentials IDs, potentially leading to unauthorized access to sensitive information stored in Jenkins.
No, authentication is not required. Users with Overall/Read permission can exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
Yes, this vulnerability can be exploited remotely by sending malicious requests to the affected HTTP endpoint.
Yes, the CVSS score for this vulnerability is 4.3 (Medium).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:xray-connector.
