Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2021-21626

CVE-2021-21626:
Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents

4.3

CVSS Score

Basic Information

CVE ID
CVE-2021-21626
GHSA ID
GHSA-7j3x-xm4j-jfj7
EPSS Score
-
CWE
CWE-862
Published
5/24/2022
Updated
10/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
io.jenkins.plugins:warnings-ngmaven<= 8.4.48.5.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly states that form validation methods lacked permission checks. In Jenkins plugins, form validation is typically implemented via doCheck* methods in Descriptor classes. The advisory specifies that the fix requires Item/Configure permission for pattern validation, indicating the vulnerable functions are the validation handlers for workspace file patterns. The naming convention (doCheckPattern) and location (plugin descriptor) follow Jenkins plugin development standards, though exact paths are inferred due to lack of code/diff access.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins W*rnin*s N*xt **n*r*tion Plu*in *.*.* *n* **rli*r *o*s not p*r*orm p*rmission ****ks in m*t*o*s impl*m*ntin* *orm v*li**tion. T*is *llows *tt**k*rs wit* It*m/R*** p*rmission *ut wit*out It*m/Worksp*** or It*m/*on*i*ur* p*rmission to ****k w*

Reasoning

T** vuln*r**ility **s*ription *xpli*itly st*t*s t**t *orm v*li**tion m*t*o*s l**k** p*rmission ****ks. In J*nkins plu*ins, *orm v*li**tion is typi**lly impl*m*nt** vi* *o****k* m*t*o*s in **s*riptor *l*ss*s. T** **visory sp**i*i*s t**t t** *ix r*quir