Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14ZnJ3LXBjbWMtcjJwM84AAn9_

Missing permission checks in Jenkins OWASP Dependency-Track Plugin allow capturing credentials

Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing "Secret text" credentials stored in Jenkins. If no credentials ID is specified, the globally configured credential is used, if set up, and can likewise be captured.

Jenkins OWASP Dependency-Track Plugin 3.1.1 requires appropriate permissions for the affected HTTP endpoints.

Permalink: https://github.com/advisories/GHSA-xfrw-pcmc-r2p3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14ZnJ3LXBjbWMtcjJwM84AAn9_
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 5 months ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-xfrw-pcmc-r2p3, CVE-2021-21632
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-21632
• https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2250
• http://www.openwall.com/lists/oss-security/2021/03/30/1
• https://github.com/jenkinsci/dependency-track-plugin/commit/70e7b82ad9a10499e628998a0bcb57c1481c66bc
• https://github.com/advisories/GHSA-xfrw-pcmc-r2p3

Repository: https://github.com/jenkinsci/dependency-track-plugin
Blast Radius: 1.0

Affected Packages