CVE-2021-21665 CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials

High 8.8 Published 10 Jun 2021 Updated 3 Aug 2024

Attackers can exploit CSRF to connect to malicious URLs using stolen credentials, capturing stored Jenkins credentials.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-21665?

CVE-2021-21665 is a high-severity vulnerability in Jenkins XebiaLabs XL Deploy Plugin, published on 10 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.

Weakness: CWE-352

Which versions are affected by CVE-2021-21665?

2 open source packages ship an affected version, including com.xebialabs.deployit.ci:deployit-plugin. It affects 1 product.

Package	Affected	Fixed in
`com.xebialabs.deployit.ci:deployit-plugin` Maven	All versions	`10.0.2`
`com.xebialabs.deployit.ci:deployit-plugin` Maven	All versions	`10.0.2`

Products include Jenkins Xebialabs Xl Deploy.

How do I fix CVE-2021-21665?

Upgrade com.xebialabs.deployit.ci:deployit-plugin to 10.0.2 or later.

Is CVE-2021-21665 being exploited?

There is no known exploitation of CVE-2021-21665 in the wild and no public exploit code.

Sources

Also known as GHSA-38pm-74xc-phcw.