CVE-2021-21678: CSRF
First published: Tue Aug 31 2021(Updated: )
An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs. SAML Plugin implements this extension point for the URL that users are redirected to after login. In Jenkins SAML Plugin 2.0.7 and earlier this implementation is too permissive, allowing attackers to craft URLs that would bypass the CSRF protection of any target URL.\n\nThis vulnerability was originally introduced in Jenkins SAML Plugin 1.1.3. Jenkins SAML Plugin 2.0.8 restricts which URLs it disables cross-site request forgery (CSRF) protection for to the one URL that needs it.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Saml | >=1.1.3<=2.0.7 | |
| maven/org.jenkins-ci.plugins:saml | <=2.0.7 | 2.0.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2021/08/31/1
- https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2469
- https://nvd.nist.gov/vuln/detail/CVE-2021-21678
- https://github.com/jenkinsci/saml-plugin/commit/e063317ee7e1c64a096e0ac323c7155b786c8b9d
- https://github.com/advisories/GHSA-r5w3-pfq8-3r82 (Advisory)
Frequently Asked Questions
What is CVE-2021-21678?
CVE-2021-21678 is a vulnerability in Jenkins SAML Plugin 2.0.7 and earlier that allows attackers to bypass CSRF protection.
How can an attacker exploit CVE-2021-21678?
An attacker can exploit CVE-2021-21678 by crafting URLs that bypass CSRF protection.
What is the severity of CVE-2021-21678?
CVE-2021-21678 has a severity rating of 8.8 (high).
How can I fix CVE-2021-21678?
To fix CVE-2021-21678, upgrade Jenkins SAML Plugin to version 2.0.8 or later.
Where can I find more information about CVE-2021-21678?
You can find more information about CVE-2021-21678 at the following references: [1] [2] [3].
- collector/nvd-index
- collector/nvd-cve
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-r5w3-pfq8-3r82
- alias/CVE-2021-21678
- collector/github-advisory
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/severity
- agent/first-publish-date
- agent/event
- agent/tags
- agent/description
- agent/trending
- vendor/jenkins
- canonical/jenkins saml
- version/jenkins saml/1.1.3
- version/jenkins saml/2.0.7
- package-manager/maven