Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-21621

CVE-2021-21621: Support bundles can include user session IDs in Jenkins Support Core Plugin

3.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-21621
GHSA ID
GHSA-92pg-8g57-hqpx
EPSS Score
0.26493%
CWE
CWE-200
Published
5/24/2022
Updated
12/15/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:support-coremaven<= 2.722.72.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from explicitly writing the raw authentication object's string representation in AboutUser.java. The patch (9af9efae6e9ed408ca89ff9b5f1b7a74da0a131f) removed the line 'out.println(" * Raw: " + Markdown.escapeBacktick(...authentication.toString()) + "")' which directly addressed the exposure. This function was clearly responsible for including sensitive session data in support bundles.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Support *or* Plu*in *.** *n* **rli*r provi**s t** s*ri*liz** us*r *ut**nti**tion *s p*rt o* t** \"**out us*r (**si* *ut**nti**tion **t*ils only)\" in*orm*tion (`us*r.m*`). In som* *on*i*ur*tions, t*is **n in*lu** t** s*ssion I* o* t** us*r *r**tin*

Reasoning

T** vuln*r**ility st*mm** *rom *xpli*itly writin* t** r*w *ut**nti**tion o*j**t's strin* r*pr*s*nt*tion in **outUs*r.j*v*. T** p*t** (****************************************) r*mov** t** lin* 'out.println(" * R*w: `" + M*rk*own.*s**p****kti*k(...*u