CVE-2021-21641: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.
Other sources
Jenkins promoted builds Plugin 3.9 and earlier does not require POST requests for HTTP endpoints implementing promotion (regular, forced, and re-execute), resulting in cross-site request forgery (CSRF) vulnerabilities.
These vulnerabilities allow attackers to promote builds.
Jenkins promoted builds Plugin 3.9.1 requires POST requests for the affected HTTP endpoints.
A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21641?
CVE-2021-21641 is categorized as a medium severity vulnerability due to its potential to allow unauthorized actions in Jenkins.
How do I fix CVE-2021-21641?
To fix CVE-2021-21641, update the Jenkins promoted builds Plugin to version 3.9.1 or later.
What type of vulnerability is CVE-2021-21641?
CVE-2021-21641 is a cross-site request forgery (CSRF) vulnerability.
Which versions of Jenkins are affected by CVE-2021-21641?
Jenkins promoted builds Plugin versions 3.9 and earlier are affected by CVE-2021-21641.
What can attackers do with CVE-2021-21641?
Attackers can exploit CVE-2021-21641 to promote builds without proper authorization.