Missing permission check in Jenkins Team Foundation Server Plugin allow capturing credentials

中危 6.5CVE-2021-21637 · GHSA-6364-jx4h-7564 · Published 30/03/2021 · updated 17/06/2026

要点

CVE-2021-21637 是影响 org.jenkins-ci.plugins:tfs, team foundation server (jenkins) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.97%，高于 62.1% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:tfs Maven	`≤ 5.157.1`	No fix yet
team foundation server jenkins	`≤ 5.157.1`	No fix yet

Description

A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2021-21637 · ADVISORY
jenkinsci/tfs-plugin · PACKAGE
jenkins.io/security/advisory/2021-03-30 · WEB
openwall.com/lists/oss-security/2021/03/30/1 · WEB
jenkins.io/security/advisory/2021-03-30

org.jenkins-ci.plugins:tfs 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:tfs

Maven

≤ 5.157.1

No fix yet

team foundation server

jenkins

≤ 5.157.1

No fix yet

Description

NVD description

org.jenkins-ci.plugins:tfs 的其他漏洞

查看全部 →