CVE-2021-21676

Vulnerability

Jenkins requests-plugin Plugin versions 2.2.7 and earlier do not perform a permission check in an HTTP endpoint [1][2]. This allows an attacker with only the Overall/Read permission to exploit the missing authorization to send test emails [1][2].

Exploitation

An attacker needs a Jenkins account with the Overall/Read permission, which is typically granted to most authenticated users. No additional privileges are required [1][2]. The attacker sends a crafted HTTP request to the vulnerable endpoint, specifying an arbitrary recipient email address [1].

Impact

Successful exploitation allows the attacker to send test emails from the Jenkins server to an attacker-specified email address [1]. This can be used for email verification, spamming, or social engineering attacks. The impact is limited to sending emails and does not directly lead to data exfiltration or code execution [2].

Mitigation

Jenkins requests-plugin Plugin version 2.2.7 is listed as fixed; users should upgrade to version 2.2.8 or later [4]. If upgrading is not immediately possible, consider restricting the Overall/Read permission to trusted users as a workaround [2][4].