Vulnerabilites related to jenkins - team_foundation_server
cve-2021-21637
Vulnerability from cvelistv5
Published
2021-03-30 11:10
Modified
2024-08-03 18:16
Severity ?
Summary
A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
References
https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2021/03/30/1mailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
Jenkins project Jenkins Team Foundation Server Plugin Version: unspecified   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:16:23.782Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29",
               },
               {
                  name: "[oss-security] 20210330 Multiple vulnerabilities in Jenkins plugins",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Jenkins Team Foundation Server Plugin",
               vendor: "Jenkins project",
               versions: [
                  {
                     lessThanOrEqual: "5.157.1",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "unspecified",
                     status: "unknown",
                     version: "next of 5.157.1",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-24T15:51:00.114Z",
            orgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
            shortName: "jenkins",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29",
            },
            {
               name: "[oss-security] 20210330 Multiple vulnerabilities in Jenkins plugins",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "jenkinsci-cert@googlegroups.com",
               ID: "CVE-2021-21637",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Jenkins Team Foundation Server Plugin",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<=",
                                          version_value: "5.157.1",
                                       },
                                       {
                                          version_affected: "?>",
                                          version_value: "5.157.1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Jenkins project",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-862: Missing Authorization",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20(2)",
                     refsource: "CONFIRM",
                     url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20(2)",
                  },
                  {
                     name: "[oss-security] 20210330 Multiple vulnerabilities in Jenkins plugins",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
      assignerShortName: "jenkins",
      cveId: "CVE-2021-21637",
      datePublished: "2021-03-30T11:10:40",
      dateReserved: "2021-01-04T00:00:00",
      dateUpdated: "2024-08-03T18:16:23.782Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-2249
Vulnerability from cvelistv5
Published
2020-09-01 13:50
Modified
2024-08-04 07:01
Severity ?
Summary
Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
References
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2020/09/01/3mailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
Jenkins project Jenkins Team Foundation Server Plugin Version: unspecified   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T07:01:41.291Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506",
               },
               {
                  name: "[oss-security] 20200901 Multiple vulnerabilities in Jenkins plugins",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2020/09/01/3",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Jenkins Team Foundation Server Plugin",
               vendor: "Jenkins project",
               versions: [
                  {
                     lessThanOrEqual: "5.157.1",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "unspecified",
                     status: "unknown",
                     version: "next of 5.157.1",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-24T16:07:50.300Z",
            orgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
            shortName: "jenkins",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506",
            },
            {
               name: "[oss-security] 20200901 Multiple vulnerabilities in Jenkins plugins",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2020/09/01/3",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "jenkinsci-cert@googlegroups.com",
               ID: "CVE-2020-2249",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Jenkins Team Foundation Server Plugin",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<=",
                                          version_value: "5.157.1",
                                       },
                                       {
                                          version_affected: "?>",
                                          version_value: "5.157.1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Jenkins project",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-256: Unprotected Storage of Credentials",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506",
                     refsource: "CONFIRM",
                     url: "https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506",
                  },
                  {
                     name: "[oss-security] 20200901 Multiple vulnerabilities in Jenkins plugins",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2020/09/01/3",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
      assignerShortName: "jenkins",
      cveId: "CVE-2020-2249",
      datePublished: "2020-09-01T13:50:35",
      dateReserved: "2019-12-05T00:00:00",
      dateUpdated: "2024-08-04T07:01:41.291Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21638
Vulnerability from cvelistv5
Published
2021-03-30 11:10
Modified
2024-08-03 18:16
Severity ?
Summary
A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
References
https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2021/03/30/1mailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
Jenkins project Jenkins Team Foundation Server Plugin Version: unspecified   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:16:23.814Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29",
               },
               {
                  name: "[oss-security] 20210330 Multiple vulnerabilities in Jenkins plugins",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Jenkins Team Foundation Server Plugin",
               vendor: "Jenkins project",
               versions: [
                  {
                     lessThanOrEqual: "5.157.1",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "unspecified",
                     status: "unknown",
                     version: "next of 5.157.1",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-24T15:51:01.313Z",
            orgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
            shortName: "jenkins",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29",
            },
            {
               name: "[oss-security] 20210330 Multiple vulnerabilities in Jenkins plugins",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "jenkinsci-cert@googlegroups.com",
               ID: "CVE-2021-21638",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Jenkins Team Foundation Server Plugin",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<=",
                                          version_value: "5.157.1",
                                       },
                                       {
                                          version_affected: "?>",
                                          version_value: "5.157.1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Jenkins project",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-352: Cross-Site Request Forgery (CSRF)",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20(2)",
                     refsource: "CONFIRM",
                     url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20(2)",
                  },
                  {
                     name: "[oss-security] 20210330 Multiple vulnerabilities in Jenkins plugins",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
      assignerShortName: "jenkins",
      cveId: "CVE-2021-21638",
      datePublished: "2021-03-30T11:10:41",
      dateReserved: "2021-01-04T00:00:00",
      dateUpdated: "2024-08-03T18:16:23.814Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21636
Vulnerability from cvelistv5
Published
2021-03-30 11:10
Modified
2024-08-03 18:16
Severity ?
Summary
A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
References
https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%281%29x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2021/03/30/1mailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
Jenkins project Jenkins Team Foundation Server Plugin Version: unspecified   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:16:23.823Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%281%29",
               },
               {
                  name: "[oss-security] 20210330 Multiple vulnerabilities in Jenkins plugins",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Jenkins Team Foundation Server Plugin",
               vendor: "Jenkins project",
               versions: [
                  {
                     lessThanOrEqual: "5.157.1",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "unspecified",
                     status: "unknown",
                     version: "next of 5.157.1",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-24T15:50:58.865Z",
            orgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
            shortName: "jenkins",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%281%29",
            },
            {
               name: "[oss-security] 20210330 Multiple vulnerabilities in Jenkins plugins",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "jenkinsci-cert@googlegroups.com",
               ID: "CVE-2021-21636",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Jenkins Team Foundation Server Plugin",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<=",
                                          version_value: "5.157.1",
                                       },
                                       {
                                          version_affected: "?>",
                                          version_value: "5.157.1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Jenkins project",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-862: Missing Authorization",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20(1)",
                     refsource: "CONFIRM",
                     url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20(1)",
                  },
                  {
                     name: "[oss-security] 20210330 Multiple vulnerabilities in Jenkins plugins",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
      assignerShortName: "jenkins",
      cveId: "CVE-2021-21636",
      datePublished: "2021-03-30T11:10:39",
      dateReserved: "2021-01-04T00:00:00",
      dateUpdated: "2024-08-03T18:16:23.823Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Vulnerability from fkie_nvd
Published
2021-03-30 12:16
Modified
2024-11-21 05:48
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
References
jenkinsci-cert@googlegroups.comhttp://www.openwall.com/lists/oss-security/2021/03/30/1Mailing List, Third Party Advisory
jenkinsci-cert@googlegroups.comhttps://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2021/03/30/1Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29Vendor Advisory
Impacted products
Vendor Product Version
jenkins team_foundation_server *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:jenkins:team_foundation_server:*:*:*:*:*:jenkins:*:*",
                     matchCriteriaId: "62126186-5625-40DE-A7A4-0F5F0B7E0A91",
                     versionEndIncluding: "5.157.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad de tipo cross-site request forgery (CSRF) en Jenkins Team Foundation Server Plugin versiones 5.157.1 y anteriores, permite a atacantes conectarse a una URL especificada por un atacante usando unos ID de credenciales especificados por el atacante obtenidas por medio de otro método, capturando credenciales almacenadas en Jenkins.",
      },
   ],
   id: "CVE-2021-21638",
   lastModified: "2024-11-21T05:48:44.777",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 6.8,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-03-30T12:16:10.987",
   references: [
      {
         source: "jenkinsci-cert@googlegroups.com",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
      },
      {
         source: "jenkinsci-cert@googlegroups.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29",
      },
   ],
   sourceIdentifier: "jenkinsci-cert@googlegroups.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-352",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-09-01 14:15
Modified
2024-11-21 05:25
Severity ?
3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
References
jenkinsci-cert@googlegroups.comhttp://www.openwall.com/lists/oss-security/2020/09/01/3Mailing List, Third Party Advisory
jenkinsci-cert@googlegroups.comhttps://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2020/09/01/3Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506Vendor Advisory
Impacted products
Vendor Product Version
jenkins team_foundation_server *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:jenkins:team_foundation_server:*:*:*:*:*:jenkins:*:*",
                     matchCriteriaId: "62126186-5625-40DE-A7A4-0F5F0B7E0A91",
                     versionEndIncluding: "5.157.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.",
      },
      {
         lang: "es",
         value: "Jenkins Team Foundation Server Plugin versiones 5.157.1 y anteriores, almacena un secreto de webhook sin cifrar en su archivo de configuración global en el controlador de Jenkins, donde los atacantes con acceso al sistema de archivos del controlador de Jenkins pueden verlo",
      },
   ],
   id: "CVE-2020-2249",
   lastModified: "2024-11-21T05:25:05.353",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 2.1,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:L/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-09-01T14:15:13.283",
   references: [
      {
         source: "jenkinsci-cert@googlegroups.com",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2020/09/01/3",
      },
      {
         source: "jenkinsci-cert@googlegroups.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2020/09/01/3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506",
      },
   ],
   sourceIdentifier: "jenkinsci-cert@googlegroups.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-311",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-03-30 12:16
Modified
2024-11-21 05:48
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
References
jenkinsci-cert@googlegroups.comhttp://www.openwall.com/lists/oss-security/2021/03/30/1Mailing List, Third Party Advisory
jenkinsci-cert@googlegroups.comhttps://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%281%29
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2021/03/30/1Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%281%29
Impacted products
Vendor Product Version
jenkins team_foundation_server *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:jenkins:team_foundation_server:*:*:*:*:*:jenkins:*:*",
                     matchCriteriaId: "62126186-5625-40DE-A7A4-0F5F0B7E0A91",
                     versionEndIncluding: "5.157.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.",
      },
      {
         lang: "es",
         value: "Una falta de comprobación de permiso en Jenkins Team Foundation Server Plugin versiones 5.157.1 y  anteriores, permite a atacantes con permiso Overall/Read enumerar unos ID de credenciales de las credenciales almacenadas en Jenkins.",
      },
   ],
   id: "CVE-2021-21636",
   lastModified: "2024-11-21T05:48:44.560",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-03-30T12:16:10.843",
   references: [
      {
         source: "jenkinsci-cert@googlegroups.com",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
      },
      {
         source: "jenkinsci-cert@googlegroups.com",
         url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%281%29",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%281%29",
      },
   ],
   sourceIdentifier: "jenkinsci-cert@googlegroups.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-862",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-03-30 12:16
Modified
2024-11-21 05:48
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
References
jenkinsci-cert@googlegroups.comhttp://www.openwall.com/lists/oss-security/2021/03/30/1Mailing List, Third Party Advisory
jenkinsci-cert@googlegroups.comhttps://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2021/03/30/1Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29
Impacted products
Vendor Product Version
jenkins team_foundation_server *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:jenkins:team_foundation_server:*:*:*:*:*:jenkins:*:*",
                     matchCriteriaId: "62126186-5625-40DE-A7A4-0F5F0B7E0A91",
                     versionEndIncluding: "5.157.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.",
      },
      {
         lang: "es",
         value: "Una falta de comprobación de permiso en Jenkins Team Foundation Server Plugin versiones 5.157.1 y anteriores, permite a atacantes con permiso general y de lectura conectarse a una URL especificada por un atacante usando unos ID de credenciales especificadas por el atacante obtenidas por medio de otro método, capturando las credenciales almacenadas en Jenkins.",
      },
   ],
   id: "CVE-2021-21637",
   lastModified: "2024-11-21T05:48:44.670",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-03-30T12:16:10.907",
   references: [
      {
         source: "jenkinsci-cert@googlegroups.com",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
      },
      {
         source: "jenkinsci-cert@googlegroups.com",
         url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2021/03/30/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29",
      },
   ],
   sourceIdentifier: "jenkinsci-cert@googlegroups.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-862",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}