Description

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.

Remediation

References

CVE-2021-21639

Related Vulnerabilities

WordPress Plugin YARPP-Yet Another Related Posts PHP Object Injection (4.4)

PHP Out-of-bounds Write Vulnerability (CVE-2022-31627)

WordPress Plugin Import Export WordPress Users Security Bypass (1.3.8)

WordPress Plugin WordPress WP-Advanced-Search Remote Code Execution (3.3.3)

PHP Other Vulnerability (CVE-2007-1396)

Severity

Medium

Classification

CVE-2021-21639 CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities