Moderate severityNVD Advisory· Published May 11, 2021· Updated Aug 3, 2024
CVE-2021-21654
CVE-2021-21654
Description
Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:p4Maven | < 1.11.5 | 1.11.5 |
Affected products
2- Range: unspecified
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-h6qv-f5gf-8gcfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-21654ghsaADVISORY
- github.com/jenkinsci/p4-plugin/commit/6b0237b04c985987460e31987d3cb314afa1ead6ghsaWEB
- www.jenkins.io/security/advisory/2021-05-11/ghsax_refsource_CONFIRMWEB
News mentions
1- Jenkins Security Advisory 2021-05-11Jenkins Security Advisories · May 11, 2021