Jenkins Security Advisory 2021-01-13

unknownCVE-2021-21603 CVE-2021-21608 CVE-2021-21610 CVE-2021-21611 CVE-2021-21604 CVE-2021-21602

Affects Jenkins Core Affects plugin: Bumblebee HP ALM Affects plugin: TICS Affects plugin: tracetronic ecu.test

CSIRTS triage

vendor: Jenkins product: Jenkins Core

What: Multiple security vulnerabilities have been identified affecting Jenkins Core and several plugins.
Who is affected: All deployments of Jenkins Core and the specified plugins are affected.
Urgency: Remediation is necessary as vulnerabilities can lead to potential exploitation.
Action: Update to the latest version of Jenkins Core and the affected plugins.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Jenkins Core

Get an email when a new Jenkins Core advisory drops — max one per day, one-click unsubscribe.

Details

Source: Jenkins Security Advisories (INTL · vendor-psirt · site)
Severity: unknown
Published: 2021-01-13
Exploitation: Not in CISA KEV at last sync

Original advisory: https://www.jenkins.io/security/advisory/2021-01-13/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2021-216031.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216081.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216101.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 65% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216111.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216041.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 75% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216022.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 81% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2018-10008621.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216052.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 81% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216061.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 66% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216071.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 71% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2021-21603	coverage & exploitation status	NVD · CVE.org
CVE-2021-21608	coverage & exploitation status	NVD · CVE.org
CVE-2021-21610	coverage & exploitation status	NVD · CVE.org
CVE-2021-21611	coverage & exploitation status	NVD · CVE.org
CVE-2021-21604	coverage & exploitation status	NVD · CVE.org
CVE-2021-21602	coverage & exploitation status	NVD · CVE.org
CVE-2018-1000862	coverage & exploitation status	NVD · CVE.org
CVE-2021-21605	coverage & exploitation status	NVD · CVE.org
CVE-2021-21606	coverage & exploitation status	NVD · CVE.org
CVE-2021-21607	coverage & exploitation status	NVD · CVE.org
CVE-2021-21609	coverage & exploitation status	NVD · CVE.org
CVE-2021-21612	coverage & exploitation status	NVD · CVE.org
CVE-2021-21613	coverage & exploitation status	NVD · CVE.org
CVE-2021-21614	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownJenkins Security Advisory 2021-01-26jenkins