CVE-2021-21647

Vulnerability

In Jenkins CloudBees CD Plugin 1.1.21 and earlier, an HTTP endpoint does not perform a permission check. This allows attackers who have at least Item/Read permission on a project to schedule builds of that project, even though they do not have the required Item/Build permission [1][2].

Exploitation

An attacker must have Item/Read permission on a Jenkins project (e.g., via a compromised low-privilege account or misconfigured authorization). With that permission, the attacker can send a crafted HTTP request to the vulnerable endpoint to trigger a build [3][4]. No additional authentication or user interaction is required beyond the initial credential compromise.

Impact

Successful exploitation bypasses the intended Item/Build permission boundary. The attacker can initiate builds of projects without authorization, potentially leading to unauthorized execution of build steps, resource consumption, or exposure of build output. The attacker does not gain code execution directly but can leverage the scheduled build to execute malicious pipeline code if other privileges permit [1][2].

Mitigation

Jenkins CloudBees CD Plugin version 1.1.22, released on April 21, 2021, fixes the permission check [3][4]. Users should upgrade to 1.1.22 or later. No workaround is documented; administrators can restrict Item/Read permissions to trusted users to reduce risk until an upgrade is applied.