CVE-2021-21677

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2021-21677

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21677.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-21677

Aliases

GHSA-58pr-hprx-7hg6

Published

2021-08-31T14:15:25Z

Modified

2024-09-03T03:40:45.475297Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability.

References

Affected packages

Git / github.com/jenkinsci/code-coverage-api-plugin

Affected ranges

Type: GIT
Repo: https://github.com/jenkinsci/code-coverage-api-plugin
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

e64303fe11b984e8f661c2ca7fe503173efdb981

Affected versions

code-coverage-api-1.*

code-coverage-api-1.0.0

code-coverage-api-1.0.0-rc-1

code-coverage-api-1.0.1

code-coverage-api-1.0.10

code-coverage-api-1.0.11

code-coverage-api-1.0.12

code-coverage-api-1.0.13

code-coverage-api-1.0.2

code-coverage-api-1.0.4

code-coverage-api-1.0.5

code-coverage-api-1.0.6

code-coverage-api-1.0.7

code-coverage-api-1.0.8

code-coverage-api-1.0.9

code-coverage-api-1.1.0

code-coverage-api-1.1.1

code-coverage-api-1.1.2

code-coverage-api-1.1.3

code-coverage-api-1.1.4

code-coverage-api-1.1.5

code-coverage-api-1.1.6

code-coverage-api-1.2.0

code-coverage-api-1.2.1

code-coverage-api-1.3.1

code-coverage-api-1.3.2

code-coverage-api-1.4.0