https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2200

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.249.x prior to 2.249.31.0.4, or 2.x prior to 2.277.4.3. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0     and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials     IDs obtained through another method, capturing credentials stored in Jenkins. (CVE-2021-21652)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers     to connect to an attacker-specified Perforce server using attacker-specified username and password.
    (CVE-2021-21655)

  - Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML     external entity (XXE) attacks. (CVE-2021-21656)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2021-21650

medium

Tenable Plugins

high