CVE-2021-21679

描述

An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs. Jenkins Azure AD Plugin implements this extension point for URLs used by a JavaScript component. In Jenkins Azure AD Plugin 179.vf6841393099e and earlier this implementation is too permissive, allowing attackers to craft URLs that would bypass the CSRF protection of any target URL. This vulnerability was originally introduced in Azure AD Plugin 164.v5b48baa961d2. Azure AD Plugin 180.v8b1e80e6f242 no longer allows bypassing CSRF protection for URLs used by the JavaScript component. Instead, that component was reconfigured to pass the expected CSRF token.

如何修補 CVE-2021-21679

要修補 CVE-2021-21679,請將受影響套件升級到下列已修補版本。

• —升級至 180.v8b1e80e6f242 或更新版本

CVE-2021-21679 正在被利用嗎?

低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 180.v8b1e80e6f242

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-21679
• PATCHgithub.com/jenkinsci/azure-ad-plugin
• WEBwww.openwall.com/lists/oss-security/2021/08/31/1
• WEBgithub.com/jenkinsci/azure-ad-plugin/commit/8b1e80e6f242275127ebb177e2a755a2104b4853