CVE-2021-21621

Опубликовано: 24 фев. 2021

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information, which can include the session ID of the user creating the support bundle in some configurations.

Ссылки

https://www.jenkins.io/security/advisory/2021-02-24/#SECURITY-2150
Vendor Advisory
https://www.jenkins.io/security/advisory/2021-02-24/#SECURITY-2150
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:support_core:*:*:*:*:*:jenkins:*:*

Версия до 2.72 (включая)

EPSS

Процентиль: 15%

0.00049

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-92pg-8g57-hqpx

CVSS3: 3.1

github

больше 3 лет назад

Support bundles can include user session IDs in Jenkins Support Core Plugin