CVE-2021-22513: CSRF
Micro Focus Application Automation Tools Plugin 6.7 and earlier does not perform permission checks in methods implementing form validation.
This allows attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specified username and password.
Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Micro Focus Application Automation Tools Plugin 6.8 requires POST requests and Overall/Administer permission for the affected form validation methods.
Other sources
Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow access without permission checks.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-22513?
CVE-2021-22513 is a missing authorization vulnerability in the Micro Focus Application Automation Tools Plugin for Jenkins.
What is the severity of CVE-2021-22513?
CVE-2021-22513 has a severity value of 6.5, which is classified as medium.
Which versions of the Micro Focus Application Automation Tools Plugin are affected by CVE-2021-22513?
CVE-2021-22513 affects version 6.7 and earlier versions of the Micro Focus Application Automation Tools Plugin for Jenkins.
How can CVE-2021-22513 be exploited?
CVE-2021-22513 could allow unauthorized access without permission checks in the Micro Focus Application Automation Tools Plugin for Jenkins.
Is there a fix available for CVE-2021-22513?
Yes, a fix is available for CVE-2021-22513. It is recommended to update to a version of the Micro Focus Application Automation Tools Plugin for Jenkins that is not affected by the vulnerability.