CVE-2021-21643

—

CVSS 3.1

6.5 medium

EPSS

1%p63

Published

Apr 21, 2021 (Apr 21, 2021)

Modified

Jun 17, 2026

Description

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.

Vendors: jenkins
Products: config file provider
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.