CVE-2021-21639

Опубликовано: 07 апр. 2021

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the config.xml REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.

Ссылки

http://www.openwall.com/lists/oss-security/2021/04/07/2
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2021-04-07/#SECURITY-1721
Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/04/07/2
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2021-04-07/#SECURITY-1721
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*

Версия до 2.277.1 (включая)

cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*

Версия до 2.286 (включая)

EPSS

Процентиль: 76%

0.00942

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

Связанные уязвимости

CVE-2021-21639

CVSS3: 4.3

ubuntu

почти 5 лет назад

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.

CVE-2021-21639

CVSS3: 3.1

redhat

почти 5 лет назад

CVE-2021-21639

CVSS3: 4.3

debian

почти 5 лет назад

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate t ...

GHSA-pvwx-3jx5-24r2

CVSS3: 4.3

github

больше 3 лет назад

Lack of type validation in agent related REST API in Jenkins

EPSS

Процентиль: 76%

0.00942

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2