CVE-2021-21661 Missing Authorization in Jenkins Kubernetes CLI Plugin

What is CVE-2021-21661?

CVE-2021-21661 is a medium-severity missing authorization vulnerability in Jenkins Kubernetes CLI Plugin, published on 10 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Which versions are affected by CVE-2021-21661?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:kubernetes-cli. It affects 1 product.

Products include Jenkins Kubernetes.

How do I fix CVE-2021-21661?

Upgrade org.jenkins-ci.plugins:kubernetes-cli to 1.10.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-21661 being exploited?

There is no known exploitation of CVE-2021-21661 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Kubernetes CLI Plugin

• CVE-2018-1999040 Exposure of Sensitive Information in Jenkins Kubernetes Plugin High 8.8
• CVE-2023-30513 Jenkins Kubernetes Plugin does not properly mask credentials High 7.5
• CVE-2018-1000187 Exposure of Sensitive Information in Jenkins Kubernetes Plugin Medium 6.5
• CVE-2020-2307 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin Medium 4.3
• CVE-2020-2308 Missing Authorization in Jenkins Kubernetes Plugin Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xrg9-wwrq-xmx9.