CVE-2021-21624 Incorrect permission checks in Jenkins Role-based Authorization Strategy Plugin may allow accessing some items

What is CVE-2021-21624?

CVE-2021-21624 is a medium-severity missing authorization vulnerability in Jenkins Role-based Authorization Strategy Plugin, published on 18 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

Weakness: CWE-863

Which versions are affected by CVE-2021-21624?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:role-strategy. It affects 1 product.

Products include Jenkins Role-Based Authorization Strategy.

How do I fix CVE-2021-21624?

Upgrade org.jenkins-ci.plugins:role-strategy to 3.1.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-21624 being exploited?

There is no known exploitation of CVE-2021-21624 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Role-based Authorization Strategy Plugin

• CVE-2023-28668 Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled Critical 9.8
• CVE-2020-2286 Improper authorization due to caching in Jenkins Role-based Authorization Strategy Plugin High 8.8
• CVE-2017-1000090 CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rm4m-39fj-288c.