Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents

中 4.3CVE-2021-21626 · GHSA-7j3x-xm4j-jfj7 · 18/03/2021 公開 · 17/06/2026 更新

要点

CVE-2021-21626 は io.jenkins.plugins:warnings-ng, warnings next generation (jenkins) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.86%（全脆弱性の 58.5% より高い）。
対処：8.5.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
io.jenkins.plugins:warnings-ng Maven	`< 8.5.0`	`8.5.0`
warnings next generation jenkins	`≤ 8.4.4`	修正版なし

概要

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.

Jenkins Warnings Next Generation Plugin 8.5.0 requires Item/Configure permission to validate patterns with workspace contents.

NVD の説明

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.