Missing permission check in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2021-21663 · ADVISORY
• jenkinsci/xldeploy-plugin · PACKAGE
• jenkins.io/security/advisory/2021-06-10 · WEB
• openwall.com/lists/oss-security/2021/06/10/14 · WEB

com.xebialabs.deployit.ci:deployit-plugin のその他の脆弱性

• CVE-2021-21665高 8.8A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an…
• CVE-2021-21664中 6.5An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to co…
• CVE-2021-21662中 4.3A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumera…
• CVE-2019-10305中 6.5A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows …
• CVE-2019-10304中 6.5A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validatio…