Unauthorized Credential Enumeration in Jenkins Team Foundation Server Plugin
CVE-2021-21636

4.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Team Foundation Server Plugin
Vendor
CVE Published:
30 March 2021

Summary

A missing permission check in Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier permits users with Overall/Read permissions to access and enumerate the IDs of stored credentials. This vulnerability exposes sensitive information, making it easier for attackers to exploit user credentials within Jenkins.

Affected Version(s)

Jenkins Team Foundation Server Plugin <= 5.157.1

References

https://www.jenkins.io/security/advisory/2021-03-30/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2021/03/30/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.