Jenkins Security Advisory 2021-06-30

Affects Jenkins Core Affects plugin: CAS Affects plugin: requests-plugin Affects plugin: Selenium HTML report

CSIRTS triage

What: Multiple vulnerabilities exist in Jenkins Core and various plugins.
Who is affected: Deployments of Jenkins Core and the listed plugins are affected.
Urgency: Remediation is necessary as vulnerabilities exist, although exploitation status is currently unknown.
Action: Update to the latest versions of Jenkins Core and the affected plugins.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Jenkins Core

Get an email when a new Jenkins Core advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2021-216702.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 79% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216711.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 75% of all EPSS-scored CVEs.
Elevated exploitation riskCVE-2021-2167242.5% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 99% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216731.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 73% of all EPSS-scored CVEs.
Low exploitation riskCVE-2021-216740.97% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 59% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216751.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 67% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-216761.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 70% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2021-21670	coverage & exploitation status	NVD · CVE.org
CVE-2021-21671	coverage & exploitation status	NVD · CVE.org
CVE-2021-21672	coverage & exploitation status	NVD · CVE.org
CVE-2021-21673	coverage & exploitation status	NVD · CVE.org
CVE-2021-21674	coverage & exploitation status	NVD · CVE.org
CVE-2021-21675	coverage & exploitation status	NVD · CVE.org
CVE-2021-21676	coverage & exploitation status	NVD · CVE.org