Remote Code Execution Vulnerability in Jenkins Templating Engine Plugin by CloudBees
CVE-2021-21646

8.8HIGH

Key Information:

Vendor: Jenkins
Status: Jenkins Templating Engine Plugin
Vendor: CVE Published:; 21 April 2021

What is CVE-2021-21646?

The Jenkins Templating Engine Plugin, versions 2.1 and earlier, lacks essential protections for pipeline configurations due to inadequate integration with the Script Security Plugin. This oversight allows users with Job/Configure permissions to potentially execute arbitrary code within the Jenkins controller JVM, exposing the system to significant security risks.

Affected Version(s)

Jenkins Templating Engine Plugin <= 2.1

References

https://www.jenkins.io/security/advisory/2021-04-21/#SECU...

x_refsource_CONFIRM

http://www.openwall.com/lists/oss-security/2021/04/21/2

mailing-listx_refsource_MLIST

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Apr 21, 2021
Vulnerability Reserved
Jan 4, 2021

JSON