| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:swarm | < 3.21 | 3.21 |
| self-organizing swarm modules | ≤ 3.20 |
Swarm Plugin adds API endpoints to add or remove agent labels. In Swarm Plugin 3.20 and earlier these only require a global Swarm secret to use, and no regular permission check is performed. This allows users with Agent/Create permission to add or remove labels of any agent.
Additionally, these API endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Swarm Plugin 3.21 requires POST requests and Agent/Configure permission for the affected agent to these endpoints. It no longer uses the global Swarm secret for these API endpoints.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free