Skip to content
Sign in
Not rated

CVE-2021-21625 Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for…

Description

Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.

Affected products and versions

Product Affected versions Fixed in
Jenkins CloudBees AWS Credentials Plugin 1.28 earliest → 1.28 No fix stated

Other CVEs of Jenkins CloudBees AWS Credentials Plugin

The 3 CVEs of Jenkins CloudBees AWS Credentials Plugin →
CVE-2022-27199 A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers… Not rated CVE-2022-27198 A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and… Not rated
Track this CVE