CVE-2021-21653

Vulnerability

The Jenkins Xray - Test Management for Jira Plugin versions 2.4.0 and earlier contain a missing permission check in an HTTP endpoint. This allows any user with Overall/Read permission (the default for authenticated users) to access the endpoint and enumerate credential IDs stored in Jenkins. The vulnerability is present in all versions up to and including 2.4.0 [1][2].

Exploitation

An attacker needs only Overall/Read permission, which is typically granted to all authenticated Jenkins users. No additional authentication, user interaction, or special privileges are required. The attacker can send a crafted HTTP request to the vulnerable endpoint to retrieve a list of credential IDs [1][2].

Impact

Successful exploitation results in the disclosure of credential IDs. While the actual credential secrets (e.g., passwords, tokens) are not exposed, the IDs can be used to identify specific credentials for targeted attacks. This information disclosure could aid in further exploitation of the Jenkins instance [1][2].

Mitigation

Jenkins released a fix in version 2.4.1 of the Xray - Test Management for Jira Plugin. Users should upgrade to 2.4.1 or later. No workarounds are documented. The plugin is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1][2].