TI-2021-04711 Aliases CVE-2021-21631 GHSA-xv69-6rf3-w5g2

Missing authorization in Jenkins Cloud Statistics Plugin

LOW 21CWE-862Published 2021-03-30 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages.

Why it matters now

EPSS 0.00801 56th percentileScored 2026-11-07

Fix Fixed org.jenkins-ci.plugins:cloud-stats (Maven): 0.27

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Cloud Statistics Plugin	up to 0.26	—	No fix listed	CNA
—	org.jenkins-ci.plugins:cloud-stats (Maven)	before 0.27	0.27	Patch available	GHSA-xv69-6rf3-w5g2

Jenkins Cloud Statistics Plugin VendorJenkins Affected up to 0.26 Fixed in — No fix listed CNA
org.jenkins-ci.plugins:cloud-stats (Maven) Vendor— Affected before 0.27 Fixed in 0.27 Patch available GHSA-xv69-6rf3-w5g2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:cloud_statistics::::::jenkins::*	up to 0.26	Vulnerable	Jenkins

cpe:2.3:a:jenkins:cloud_statistics:*:*:*:*:*:jenkins:*:* Versions up to 0.26 Vulnerable ·Jenkins

Remediation

Fix · GHSA-xv69-6rf3-w5g2 org.jenkins-ci.plugins:cloud-stats (Maven) Fixed in 0.27 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-21631
2026-10-03 Alias added: GHSA-xv69-6rf3-w5g2

References

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences