GitHub Advisoryadvisory · Maven

GHSA-pvwx-3jx5-24r2 Lack of type validation in agent related REST API in Jenkins

MEDIUM Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2021-21639
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20
Reviewed
2022-06-23

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.277.2 → fixed in 2.277.2 • Maven org.jenkins-ci.main:jenkins-core: >= 2.278, < 2.287 → fixed in 2.287

Description

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node. This allows attackers with Computer/Configure permission to replace a node with one of a different type. Jenkins 2.287, LTS 2.277.2 validates the type of object created and rejects objects of unexpected types.

Related

Alias · CVE (1)

  • CVE-2021-21639 Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References