Incorrect Authorization Affecting org.jenkins-ci.main:jenkins-core package, versions [2.266,2.289.2) [2.292,2.300)
Threat Intelligence
EPSS
0.05% (24th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIMAIN-3175467
- published 18 Dec 2022
- disclosed 24 May 2022
- credit NotMyFault
Introduced: 24 May 2022
CVE-2021-21670 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.main:jenkins-core to version 2.289.2, 2.300 or higher.
Overview
org.jenkins-ci.main:jenkins-core is an open source automation server.
Affected versions of this package are vulnerable to Incorrect Authorization which allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.
Workaround
Users that are not able to upgrade to the fixed version should not grant Item/Cancel permission to users who do not have Item/Read permission.
CVSS Scores
version 3.1