Description

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.

Remediation

References

CVE-2021-21639

Related Vulnerabilities

Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-4791)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-5278)

WordPress Plugin Booking.com Product Helper Unspecified Vulnerability (1.0.3)

MySQL CVE-2022-21334 Vulnerability (CVE-2022-21334)

Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-20099)

Severity

Medium

Classification

CVE-2021-21639 CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities