CVE-2021-21621

Description

Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the \"About user (basic authentication details only)\" information (`user.md`). In some configurations, this can include the session ID of the user creating the support bundle. Attackers with access to support bundle content and the Jenkins instance could use this information to impersonate the user who created the support bundle. Support Core Plugin 2.72.1 no longer provides the serialized user authentication as part of the \"About user (basic authentication details only)\" information. As a workaround, deselecting \"About user (basic authentication details only)\" before creating a support bundle will exclude the affected information from the bundle.

How to fix CVE-2021-21621

To remediate CVE-2021-21621, upgrade the affected package to a fixed version below.

• —upgrade to 2.72.1 or later

Is CVE-2021-21621 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 2.72.1

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-21621
• PATCHgithub.com/jenkinsci/support-core-plugin
• WEBgithub.com/jenkinsci/support-core-plugin/commit/9af9efae6e9ed408ca89ff9b5f1b7a74da0a131f
• WEBwww.jenkins.io/security/advisory/2021-02-24/#SECURITY-2150