Skip to content
Fencer Vulns
medium 6.5

CVE-2021-21643 json

Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs

published 2021-04-21 5 y ago modified 2026-06-17 4 mo ago also GHSA-3m3f-2323-64m7 , EUVD-2022-2206

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.

Patch / fix

  • maven org.jenkins-ci.plugins:config-file-provider 3.7.1
  • runc openshift 4.8 1.0.0-98.rhaos4.8.gitcd80260.el7
  • runc openshift 4.8 1.0.0-98.rhaos4.8.gitcd80260.el8
  • cri-o openshift 4.8 1.21.2-5.rhaos4.8.gitb27d974.el7
  • cri-o openshift 4.8 1.21.2-5.rhaos4.8.gitb27d974.el8
  • butane openshift 4.8 0.12.1-1.rhaos4.8.el8
  • ostree openshift 4.8 2020.7-5.el8_4
  • podman openshift 4.8 3.0.1-6.el8
  • haproxy openshift 4.8 2.2.13-1.el7

red hat advisories RHSA-2021:2437RHSA-2021:2122RHSA-2021:2431RHSA-2021:2517RHBA-2021:2407

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21643 updated cvss 4.3

jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP endpoints.

  • Red Hat Migration Toolkit 1.4 rhmtc/openshift-migration-ui-rhel8 v1.4.6-4, rhmtc/openshift-velero-plugin-rhel8 v1.4.6-4, rhmtc/openshift-migration-velero-rhel8 v1.4.6-5, rhmtc/openshift-migration-registry-rhel8 v1.4.6-4, rhmtc/openshift-migration-operator-bundle v1.4.6-5, rhmtc/openshift-migration-controller-rhel8 v1.4.6-4, +7 more
    fixed: vendor fix RHBA-2021:2854
  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins 3.11.1624366838-1.el7
    fixed: vendor fix RHSA-2021:2517
  • Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins 4.5.1623326336-1.el7
    fixed: vendor fix RHSA-2021:2431
  • Red Hat OpenShift Container Platform 4.6 jenkins-2-plugins 4.6.1623162648-1.el8
    fixed: vendor fix RHBA-2021:2407
  • Red Hat OpenShift Container Platform 4.7 cri-tools 1.20.0-3.el7, redhat-release-coreos 47.83-2.el8, jenkins-2-plugins 4.7.1621361158-1.el8, cri-o 1.20.2-12.rhaos4.7.git9f7be76.el7, cri-o 1.20.2-12.rhaos4.7.git9f7be76.el8
    fixed: vendor fix RHSA-2021:2122
  • Red Hat OpenShift Container Platform 4.8 podman 3.0.1-6.el8, haproxy 2.2.13-1.el7, haproxy 2.2.13-1.el8, ostree 2020.7-5.el8_4, cri-tools 1.21.0-2.el7, cri-tools 1.21.0-2.el8, +134 more
    fixed: vendor fix RHSA-2021:2437
  • Red Hat OpenShift Container Platform 3.11 python-requests 2.19.1-5.el7, python2-requests 2.19.1-5.el7, jenkins 2.289.1.1624365627-1.el7, prometheus 3.11.462-1.git.99aae51.el7, openshift-kuryr 3.11.462-1.git.c33a657.el7, atomic-openshift 3.11.462-1.git.0.e7d0362.el7, +37 more Red Hat OpenShift Container Platform 4.5 jenkins 2.277.3.1623846768-1.el7, openshift 4.5.0-202106011407.p0.git.d8ef5ad.el7, openshift 4.5.0-202106011407.p0.git.d8ef5ad.el8, openshift-kuryr 4.5.0-202106011407.p0.git.75cc301.el8, openshift-ansible 4.5.0-202106011407.p0.git.83db419.el7, openshift-clients 4.5.0-202106011407.p0.git.297a4ac.el7, +12 more Red Hat OpenShift Container Platform 4.6 pprof 2.6.3-3.el8cp, gperftools 2.6.3-3.el8cp, gperftools-libs 2.6.3-3.el8cp, jenkins 2.263.3.1623239705-1.el8, cri-o 1.19.2-4.rhaos4.6.git4f7cb5e.el7, cri-o 1.19.2-4.rhaos4.6.git4f7cb5e.el8, +4 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.plugins:config-file-provider
<3.7.1
3.7.1

Affected products

  • Jenkins project Jenkins Config File Provider Plugin

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.