Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2021-22513

CVE-2021-22513:
Missing permission checks in Micro Focus Application Automation Tools Plugin

4.3

CVSS Score

Basic Information

CVE ID
CVE-2021-22513
GHSA ID
GHSA-7qp2-rgxr-29q4
EPSS Score
-
CWE
CWE-862
Published
5/24/2022
Updated
12/19/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:hp-application-automation-tools-pluginmaven<= 6.77.2.3-beta

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from form validation methods lacking permission checks (CWE-862) and CSRF protections. The commit patching CVE-2021-22513 explicitly adds Jenkins.ADMINISTER permission checks and @RequirePOST annotations to these methods. The affected methods handle sensitive operations like server URL validation and connection testing, which were previously accessible to users with only Overall/Read permission via GET requests. The patch confirms these were the vulnerable entry points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Mi*ro *o*us *ppli**tion *utom*tion Tools Plu*in *.* *n* **rli*r *o*s not p*r*orm p*rmission ****ks in m*t*o*s impl*m*ntin* *orm v*li**tion. T*is *llows *tt**k*rs wit* Ov*r*ll/R*** p*rmission to *onn**t to *tt**k*r-sp**i*i** URLs usin* *tt**k*r-sp**i

Reasoning

T** vuln*r**ility st*ms *rom *orm v*li**tion m*t*o*s l**kin* p*rmission ****ks (*W*-***) *n* *SR* prot**tions. T** *ommit p*t**in* *V*-****-***** *xpli*itly ***s J*nkins.**MINIST*R p*rmission ****ks *n* @R*quir*POST *nnot*tions to t**s* m*t*o*s. T**