Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-21636

CVE-2021-21636: Missing permission check in Jenkins Team Foundation Server Plugin allows enumerating credentials IDs

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-21636
GHSA ID
GHSA-vg28-9f43-gmh5
EPSS Score
0.0722%
CWE
CWE-862
Published
5/24/2022
Updated
10/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:tfsmaven<= 5.157.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from an unauthenticated HTTP endpoint handler in the TFS plugin. Jenkins plugins typically implement web endpoints via do* methods in Java classes. The advisory explicitly mentions credential ID enumeration through an HTTP endpoint with missing authorization (CWE-862), which aligns with Jenkins' pattern of requiring checkPermission() calls in web methods. While the exact method name isn't disclosed, TeamFoundationServerWebHookManagement is a core TFS plugin class that would handle credential-related operations, and the doGetCredentialIds naming follows Jenkins' convention for parameter retrieval endpoints.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins T**m *oun**tion S*rv*r Plu*in *.***.* *n* **rli*r *o*s not p*r*orm * p*rmission ****k in *n *TTP *n*point. T*is *llows *tt**k*rs wit* Ov*r*ll/R*** p*rmission to *num*r*t* *r***nti*ls I*s o* *r***nti*ls stor** in J*nkins. T*os* **n ** us** *s

Reasoning

T** vuln*r**ility st*ms *rom *n un*ut**nti**t** `*TTP` *n*point **n*l*r in t** T*S plu*in. J*nkins plu*ins typi**lly impl*m*nt w** *n*points vi* `*o*` m*t*o*s in J*v* *l*ss*s. T** **visory *xpli*itly m*ntions *r***nti*l I* *num*r*tion t*rou** *n `*TT