CVE-2021-21639

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API…

published April 7, 2021

CVSS
—
EPSS
3%
Percentile
85.9
In the wild
Unconfirmed
What it is

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02725 · 85.9th percentile
Published
2021-04-07T13:50Z
EPSS history
Timeline
  • 07 APR 13:50Z
    Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API…
    cvelistv5