CVE-2021-21664: Incorrect Authorization

May 24, 2022 (updated December 14, 2022)

An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.

References

www.openwall.com/lists/oss-security/2021/06/10/14
github.com/advisories/GHSA-jm4g-8rvq-v87j
nvd.nist.gov/vuln/detail/CVE-2021-21664
www.jenkins.io/security/advisory/2021-06-10/

Detect and mitigate CVE-2021-21664 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →