CVE-2021-21623 Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items
Attackers with read access to nested items can bypass parent folder restrictions to view unauthorized content in Jenkins.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21623?
CVE-2021-21623 is a medium-severity missing authorization vulnerability in Jenkins Matrix Authorization Strategy Plugin, published on 18 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.
Weakness: CWE-863
Which versions are affected by CVE-2021-21623?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:matrix-auth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:matrix-auth Maven | All versions | 2.6.6 |
org.jenkins-ci.plugins:matrix-auth Maven | All versions | 2.6.6 |
Products include Jenkins Matrix Authorization Strategy.
How do I fix CVE-2021-21623?
Upgrade org.jenkins-ci.plugins:matrix-auth to 2.6.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-21623 being exploited?
There is no known exploitation of CVE-2021-21623 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Matrix Authorization Strategy Plugin
Sources
Also known as GHSA-96jw-3xw4-mq9p.