Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-21637

CVE-2021-21637: Missing permission check in Jenkins Team Foundation Server Plugin allow capturing credentials

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-21637
GHSA ID
GHSA-6364-jx4h-7564
EPSS Score
0.14756%
CWE
CWE-862
Published
5/24/2022
Updated
10/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:tfsmaven<= 5.157.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The identified functions are based on typical areas where such vulnerabilities occur (HTTP handling and credential management). The exact function names are inferred from common practices in Jenkins plugin development and the nature of the described vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* missin* p*rmission ****k in J*nkins T**m *oun**tion S*rv*r Plu*in *.***.* *n* **rli*r *llows *tt**k*rs wit* Ov*r*ll/R*** p*rmission to *onn**t to *n *tt**k*r-sp**i*i** URL usin* *tt**k*r-sp**i*i** *r***nti*ls I*s o*t*in** t*rou** *not**r m*t*o*, **

Reasoning

T** i**nti*i** *un*tions *r* **s** on typi**l *r**s w**r* su** vuln*r**iliti*s o**ur (*TTP **n*lin* *n* *r***nti*l m*n***m*nt). T** *x**t *un*tion n*m*s *r* in**rr** *rom *ommon pr**ti**s in `J*nkins` plu*in **v*lopm*nt *n* t** n*tur* o* t** **s*ri**