Skip to main content

Requests CVE-2021-21674

MEDIUM
2021-06-30 jenkinsci-cert@googlegroups.com
Jenkins Information Disclosure Requests
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 30, 2021 - 17:15 nvd
MEDIUM 4.3

DescriptionNVD

A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending requests.

AnalysisAI

A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending requests. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending requests. Affected products include: Jenkins Requests.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Requests

View all
CVE-2018-18074 HIGH POC
7.5 Oct 09

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-ho
CVE-2021-29476 CRITICAL
9.8 Apr 27

Requests is a HTTP library written in PHP. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
CVE-2015-2296 MEDIUM
6.8 Mar 18

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session
CVE-2021-21675 MEDIUM
6.5 Jun 30

A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers

CVE-2023-32681 MEDIUM
6.1 May 26

Requests is a HTTP library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticat
CVE-2014-1829 MEDIUM
5.0 Oct 15

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorizatio
CVE-2014-1830 MEDIUM
5.0 Oct 15

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-A
CVE-2022-34782 MEDIUM
4.3 Jun 30

An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read pe
CVE-2021-21676 MEDIUM
4.3 Jun 30

Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attac

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2021-21674 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy