CVE-2021-21679

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Azure AD Plugin	>= 164.v5b48baa961d2, < unspecified; >= unspecified, <= 179.vf6841393099e

References

http://www.openwall.com/lists/oss-security/2021/08/31/1Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2470Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/08/31/1Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2470Vendor Advisory

Timeline

Published: Aug 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-216807.1Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.CVE-2021-216815.5Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where the CVE-2021-216824.3Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially repla CVE-2021-216836.5The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting i CVE-2021-216846.1Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them CVE-2021-216859.1Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs CVE-2021-216868.1File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize pa CVE-2021-216879.1Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a sym CVE-2021-216887.5The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject a CVE-2021-216899.1FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and e CVE-2021-21694.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.33 an CVE-2021-216909.8Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and