Skip to content
Sign in
Not rated

CVE-2021-21632 A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read…

Description

A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins.

Affected products and versions

Product Affected versions Fixed in
Jenkins OWASP Dependency-Track Plugin 3.1 earliest → 3.1.0 No fix stated
Jenkins OWASP Dependency-Track Plugin 1.1 1.1.0 → latest No fix stated

Other CVEs of Jenkins OWASP Dependency-Track Plugin

The 2 CVEs of Jenkins OWASP Dependency-Track Plugin →
CVE-2021-21633 A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows… Not rated
Track this CVE