User Authentication Vulnerability in Jenkins Support Core Plugin by Jenkins
CVE-2021-21621

5.3MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Support Core Plugin
Vendor
CVE Published:
24 February 2021

What is CVE-2021-21621?

The Jenkins Support Core Plugin prior to version 2.73 is susceptible to a user authentication exposure issue. This vulnerability allows the serialized user authentication data to be included in the 'About user' information, which can inadvertently disclose sensitive session IDs of users creating support bundles. This presents a risk of unauthorized access if attackers are able to exploit the information provided through this plugin.

Affected Version(s)

Jenkins Support Core Plugin <= 2.72

Jenkins Support Core Plugin 2.70.1

Jenkins Support Core Plugin 2.68.1

References

https://www.jenkins.io/security/advisory/2021-02-24/#SECU...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.