CVE-2021-21663: XebiaLabs XL Deploy Plugin - Missing Permission Check
Summary
CVE-2021-21663: Missing permission check in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials. Affects com.xebialabs.deployit.ci:deployit-plugin versions < 10.0.2. Fixed in 10.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The XebiaLabs XL Deploy Plugin is a plugin for Jenkins, an open-source automation server. It allows users to connect to XL Deploy, a deployment automation tool, and perform various deployment tasks. The plugin integrates Jenkins with XL Deploy, enabling users to deploy applications and manage deployments directly from Jenkins. This vulnerability affects versions 7.5.8 and earlier of the XebiaLabs XL Deploy Plugin.
Vulnerability Detail
The XebiaLabs XL Deploy Plugin version 7.5.8 and earlier has a missing permission check vulnerability. Attackers with Overall/Read permission can exploit this vulnerability to connect to a specified URL using attacker-specified credentials IDs obtained through another method. This allows them to capture Username/password credentials stored in Jenkins. The vulnerability has a CVSS score of 7.1, indicating a high severity level. The CWE ID associated with this vulnerability is CWE-862.
How To Fix
Latest published version: 26.3.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the XebiaLabs XL Deploy Plugin to mitigate the risk.
Conclusion
The XebiaLabs XL Deploy Plugin version 7.5.8 and earlier is vulnerable to a missing permission check issue that allows attackers to capture credentials stored in Jenkins. To mitigate this vulnerability, users should upgrade to version 10.0.2 or later of the plugin. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.xebialabs.deployit.ci:deployit-plugin →
FAQ
This vulnerability allows attackers with Overall/Read permission to capture Username/password credentials stored in Jenkins. This can lead to unauthorized access to sensitive information and potential misuse of credentials.
Users of XebiaLabs XL Deploy Plugin versions 7.5.8 and earlier are affected by this vulnerability.
There is no known exploit for this vulnerability at the time of this advisory.
The only effective mitigation for this vulnerability is to upgrade to version 10.0.2 or later of the XebiaLabs XL Deploy Plugin.
For more information about this vulnerability, refer to the GitHub Security Advisory GHSA-6mpp-cm3v-23vv.
Related vulnerabilities
Recent vulnerabilities recorded for com.xebialabs.deployit.ci:deployit-plugin.
