Jenkins Security Advisory 2021-04-07

Affects Jenkins Core Affects plugin: OpenText Application Automation Tools Affects plugin: promoted builds

CSIRTS triage

What: Multiple plugins and Jenkins Core are affected by security vulnerabilities.
Who is affected: Deployments of Jenkins Core and the affected plugins.
Urgency: Remediation is necessary as vulnerabilities could be exploited, though exploitation status is currently unknown.
Action: Update Jenkins Core and the affected plugins to their latest versions.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Jenkins

Get an email when a new Jenkins advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2021-216392.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 85% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216401.9% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 78% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216411.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 64% of all EPSS-scored CVEs.
Low exploitation riskCVE-2021-225120.72% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-225131.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 65% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-225105.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 92% of all EPSS-scored CVEs.
Low exploitation riskCVE-2021-225110.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2021-21639	coverage & exploitation status	NVD · CVE.org
CVE-2021-21640	coverage & exploitation status	NVD · CVE.org
CVE-2021-21641	coverage & exploitation status	NVD · CVE.org
CVE-2021-22512	coverage & exploitation status	NVD · CVE.org
CVE-2021-22513	coverage & exploitation status	NVD · CVE.org
CVE-2021-22510	coverage & exploitation status	NVD · CVE.org
CVE-2021-22511	coverage & exploitation status	NVD · CVE.org