CVE-2021-21653

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-21653

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21653.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-21653

Aliases

GHSA-5557-j87h-cvf4

Published

2021-05-11T15:15:08.070Z

Modified

2025-11-20T11:32:57.180320Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

References

https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2251%20%282%29

Affected packages

Git / github.com/jenkinsci/xray-connector-plugin

Affected ranges

Type: GIT
Repo: https://github.com/jenkinsci/xray-connector-plugin
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

29b3791f7c34e0ff0570744514f79f18363dc772

Affected versions

v1.*

v1.1.0

v1.2.0

v1.2.1

v1.3.0

v2.*

v2.0.0

v2.0.1

xray-connector-2.*

xray-connector-2.1.1

xray-connector-2.1.2

xray-connector-2.2.0

xray-connector-2.3.0

xray-connector-2.3.1

xray-connector-2.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21653.json"